yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] cellzealot:
VZW has known about this for over 6 years...just an FYI...they setup EvDO authentication on their network knowing it could be vulnerable to NVM tampering. Just a compromise they made at the time.
[Motorola Droid 3] LRiley:
can anybody that has not done this just use the steps to give me the correct hex for 8401-8403 please?
[Motorola Droid 3] rushless:
Cool if you are correct, but the data strings of the radio seem a pretty basic and absolute point of control. The end game is an LTE network that has decent policing function for data control.

I think the Moto radio chip and "warnings" are the first steps on the bridge to getting there. Question is how adventurous will people be if they know they may lose their unlimited data? VZW has

a very specific agenda: Rid non-contracted tethering as much as possible.
[Motorola Droid 3] JRowe47:
The hardware is ultimately in our hands, and they can't babysit every packet (legally, ethically, or practically.) With a sane vpn setup, there's no way for them to realistically inspect the data passing over the network, so they're left with simply monitoring bandwidth, which is what they should be doing anyway.

VZW's agenda is more specific than that, they're in this to make money. Wrestling with unauthorized tethering is a loser's gambit. They'll either reduce their activities to a token fuss over a few users to intimidate the stupid, or ditch it altogether. Either way, it doesn't mean anything for us, the power users. If they upset us, we post bad things on forums, and neophytes see the negative and go for the safe choice - the iPhone.

If you're not abusing bandwidth or doing stupid illegal **** with your phone, VZW's probably just happy to have your business. They're making something like $100 a month off of the smart phone owners, why the hell would they kill the goose?
[Motorola Droid 3] elkay:
This pretty much sums it up.
[Motorola Droid 3] rushless:
Unless At&t are nuts (possible) they are forcing people that are caught to use limited data plans. I do not think companies are being as pragmatic about this as some are assuming.

Be nice if they were being more “big picture”, but why would they go through the effort of warning people and having the steps set up in the first place (this is a collaboration with the OEM as well)? By the premise of making money, VZW would not have invested in those costs either, if the goose is so coveted. They could simply police heavy data users and focus on them. This effort seems more objective.

I used to tether with my Incredible, so not being a hypocrite. Perhaps they will not clamp down like At&t until the LTE network is complete. If so, that is a few more years.
[Motorola Droid 3] zeroktal:
BLue Dot only

Anyone else only able to get a blue or yellow dot? I've tried on XP and on Windows 7. MotoHelper 2.0.51 Driver 5.2.0 and RadioComm 11.11.7.
[Motorola Droid 3] bcwatson:
Droid X2?

I know these directions were written to provide tethering for the Droid 3, but will they work to provide tethering for the Droid X2 also? If so, any differences in the procedures? I'm on 2.3.3 ...
[Motorola Droid 3] ich511:
Since I wouldn't know how to ask TBH myself, I'll post in here...

just wondering if it would be possible to bypass the call forward blocking by hacking the radio part as well?
[Motorola Droid 3] randallman:
Does this actually work on the newer 890 OTA?

Does this actually work on the newer 890 OTA?

After it flashed the radio firmware, I fully expected the SEEMs to be returned to the stock values, however when I checked with RadComm, they were as I had set them prior to the 890 update.

So just for grins, I re-set the seems at 8041, 8042, and 8043 with the contents of 8040 despite the fact that they were already identical. Then, I did a *228, option 1 and a few reboots. However the hotspot app is still not providing internet access to my ASUS TF101 Eeepad.

I can still start the hotspot app and get my pad is able to obtain an IP address and ping the .1 address (the phone), but is unable to reach the network beyond the phone.

Could it be the VZW decided to get smarter? Does the new radio baseband change the process in any way? Or am I just really unlucky.
[Motorola Droid 3] lordgodgeneral:
Something must have happened and the radio didn't flash correctly. After I did the 890 update, I was forced to do a *228 option 1 to get my phone back up on verizon. When I hooked up to radiocomm, the values had been reset to stock. Redid the hack and everything is working great for mine, can tether my transformer, laptop, and viewsonic g tab without any problems.
[Motorola Droid 3] randallman:
Well that's just dandy... :) Im just an unlucky soul it seems. Imma go check to see if my winders XP craptop tethers to the phone.

I suppose the correct baseband version is: N_03.18.29P

---------- Post added at 12:37 PM ---------- Previous post was at 11:44 AM ----------

Ok, go figure - I went and tethered my XP laptop and that worked fine... then I came back and did the same for my Transformer and it worked fine...

Flakey to say the least ;)

But it works, sorry for the questions and thanks for the help.
[Motorola Droid 3] jfourman:
New baseband N_03.18.29P does not effect tether hack

I expected the 5.6.890 / baseband N_03.18.29P update would wipe the tether hack. It didn't. I updated using the "leaked" OTA version. My baseband is now N_03.18.29P. I opened Radiocomm to view the memory locations and the values remained as they were before the update. The Mobile Hotspot works fine.
[Motorola Droid 3] jediman:
Worked like a charm .. posted via tethered notebook :-D
[Motorola Droid 3] Raa_1:
Same here, haven't done the hack yet, but it doesn't sound like it'll work anyway.

Anyone got any suggestions for GSM users? :)
[Motorola Droid 3] cellzealot:
It definitely will not work on any GSM network where data authentication is controlled and stored on the SIM and not in the NVM. There are often analogous hacks to accomplish the same result but they are usually editing the APN config in the OS, since that is typically how the tethering distinction is managed on GSM networks. This is entirely carrier dependent and any mods would be specific to your carrier.
[Motorola Droid 3] Raa_1:
That also explains why Telstra is hating me when I use MMS as well. It works, but it's at a terrible quality.

Basically, I need a different phone I would assume... (Tethering is supported by Telstra, and does work on other phones)
[Motorola Droid 3] djthread:
So... I'm experiencing the not-so-good result I see a couple other people with. 3G (thankfully) seems to work ok normally, but the moment I start up the wireless hotspot, the data connection becomes extremely slow or non-existent for maybe 10-15 seconds until the 3G icon disappears. It reappears a few seconds later only to have the process repeat.

My totally uneducated guess is that Verizon is onto this approach somehow, and their solution is just to reset the 3G connection when they see it. The phone automatically reconnects, and the process repeats.

I even double-checked the values I have in the 8040-8043 registers, and they are still as I set them -- all the same. I feel good about having followed the directions correctly.

(Extra notes: The "get" button wouldn't get me the version number as others have also mentioned, and I didn't see any "bad sim" message, either.)

I've tried several reboots including a battery pull... but I can't shake this behavior. Is anyone still using this approach with success?
[Motorola Droid 3] lordgodgeneral:
I've done it several times now with no problems, first on stock then on update, and then after I had to flash the sbf after messing a bit too much. All times worked great. I'm running radiocomm on windows 7, got the green light and get returned the right values.

Have no issues tethering my old viewsonic g tab, my transformer or my windows laptop.
[Motorola Droid 3] djthread:
Weirdness... I guess my phone just needed to get used to the newly flipped bits... cuz here I am a few hours later, trying again...

And everything seems to be working just fine!

Thanks to all involved with this glorious hack!!
[Motorola Droid 3] redsox985:
So, I'm having some trouble with my wireless tether. I successfully used it while driving 10 hours to Illinois on Friday and downloaded about a gig of data (probably shouldn't have in hindsight) but I did anyways and then on Sunday, on the way home, I went to connect my laptop only to find that it could connect, but had "no internet connection". I still had mobile data and the 8040-8043 strings were all identical when pulled from RC. Could VZW have blocked my tethering some other way?
[Motorola Droid 3] iSpencerPro:
I did everything as told and I can't get my droid to be recognized by radio com. It just won't turn to a green light. The best I get is like a magenta color or a pink Idk how to describe. I've tried it on a windows 7 32 bit computer. I accidently clicked the wrong chipset on my laptop w/out android. (I tried the phone on the computer that has the right chipset) and I'm scared to try it on the laptop because its the different chipset. Any ideas on what I can do to fix this I'd really like wireless tether
[Motorola Droid 3] elkay:
Isn't the magenta LAN instead of USB? I think it will work both ways, but don't quote me on it.
[Motorola Droid 3] cellzealot:
Either driver mode works. magenta for LAN and green for USB.
[Motorola Droid 3] iSpencerPro:
So I'm about to try it on desktop and see if I can get it to work without the green light. Anything i should pay close attention to? or people had a hard time on
[Motorola Droid 3] eth3rton:
Holy ****!

It works!! Droid X2 here....

Thank you everyone!!
[Motorola Droid 3] masters:
Does this work with 2.3.4? I am also having problems installing RadioComm says it's to old.. And doesn't get past that point on 64bit Win 7..

I need to find all the files again.. Maybe I will try on an old XP, not sure if that matters..

Any Ideas?
[Motorola Droid 3] elkay:
I had no problem on Win 7 x64. I got that error message, but you can just confirm right past it.
[Motorola Droid 3] masters:
which version of radiocomm?
[Motorola Droid 3] elkay:
Just checked: v11.11.11
[Motorola Droid 3] nu2droid:
I am going to give this a try, but I have a question first.

Do you actually need it. I have the app wireless tether that I downloaded from somewhere. I click it, give root permissions and start tethering. Have not seen anything on my bill, ro re-direction to any vz webpages and it appears to work.
[Motorola Droid 3] dpwhitty11:
If you already have it working, I see no reason to do this.

What version of the app are you using?
[Motorola Droid 3] faylix:
I want more thanks for this thread.... :mad:
[Motorola Droid 3] cellzealot:
Hehe, folks here aren't too generous with the thanks button...I have no idea why.
[Motorola Droid 3] faylix:
bunch of mean people on XDA.... :p

- faylix / local

(finally rooted my droid and on darkdroid blah blah).
[Motorola Droid 3] nu2droid:
Using wireless tether version 2.0.7

The file that was posted with the edits. It includes the tweaked numbers for 8040,41,42,43 and the second file contains the un-tweeaked version to undo the hack.

Question: Did I see the numbers correct, only the 8040 was different? Looked like 8041,42,43 128 bit #s are identical. Is that correct?
[Motorola Droid 3] GoodLooks550:
if i went through the 'wipe data/factory reset' option in the bootstrap, does the hack go away? Thanks.
[Motorola Droid 3] faylix:
no. you haven't touched the radio.

- faylix / local
[Motorola Droid 3] daimerion:
Frustrated

I've tryed doing this two ways. The way put forth in the op and the one on page 2 or 3. Nothing works for me. When I try to Get s/w version it shows in the box as an error. I pushed forward and tryed to find the dec strings and after inputting the numbers, it also shoots back an error. The info at the bottom of Radiocomm shows my phone so I assume it's making a connection to it. The errors all seem to show connection issues. I dont have the details with me at the moment but will repost later with the details.
[Motorola Droid 3] cellzealot:
If you can't get it to read the S/W version it is always a driver/interface issue and you have to try reloading your drivers or getting a newer set and going over everything again with your config.

Whenever you load a new set of drivers your PC will go through the new hardware found dialog and its always a good idea to force it to load all of the various device interfaces by selecting each option in the USB connection drop down and allowing Windows to load the drivers for each one and then going back to PC mode. Also its generally best to reboot both phone and PC after the drivers have all loaded successfully. There are at least fifteen different device interfaces that present to Windows depending on the state of the connected phone, many of which only load in specific circumstances.

All this is just to point out that its complicated, but it should be able to work on any properly configured PC running any Win version and I have done it on all models of Motorola devices on every version.
[Motorola Droid 3] daimerion:
Thank you so much for the direction!! I uninstalled/reinstalled moto helper and plugged into a diff usb to initiate the drivers to reinstall. BINGO!! Using my d3 tethered now. Thank You

Thank You

Thank You
[Motorola Droid 3] Arikara:
Hello all! I think I did something wrong? My Green light doesn't come on? The computer reads it with the neat little interface and all? Put the Phone in PC Mode? Need a little help.
[Motorola Droid 3] WugFresh:
Was thinking about simplifying this process for people with some autoit script. I don't have a D3 or X2 but I like making things simpler with code; I may need some help getting window info on radiocomm (unless I can get it to recognize my DX), so if you have a D3/X2 and are willing to help, please let me know. The information I need is very easy to get.

Also, do you guys think that having the script I write automatically download radiocomm from a third party site would be 'ok'...? Maybe with a user prompt & disclaimer first, kinda thing? I wouldn't be the one hosting it or directly distributing it, so its all good, right?

Big thanks to the OP for posting the information and to TBH for discovering/publishing the original exploit.

{{ WugFresh }}
[Motorola Droid 3] cellzealot:
Yo Wug! I think that sounds like a good way to get in trouble actually, perhaps I am wrong.

Either way, it is a tremendously complicated way of making this procedure easier.

It would be much simpler to examine update.zip files we released for the DX and D2 and modify them for the D3 and DX2. There are reasons why we haven't done this ourselves, which I have stated here in this thread briefly, but that doesn't prevent someone else from undertaking that task.

We feel that making it as simple as loading an update.zip from CWM on a rooted phone to make this kind of low level modifications to the radio which are not well understood nor easily managed by those same end users is not a good idea. I do not want to restart the debate about tethering and whether it should or shouldn't be "free", I simply wanted to clarify our position on why we haven't made this more accessible.
[Motorola Droid 3] jjhiza:
That's an excellent point actually. Simplifying the process sounds good in theory, but it could also create a pocket of end users who aren't educated (in Android terms) enough to understand the process, take it for granted, and end up spamming threads for help if/when they run into a problem. The same thing happened with root apps like Z4…they took all the know-how out of the process, and many people didn't know enough to recover from errors. ROM Manager will occasionally cause these kinds of issues as well… I found that learning some minor details, and educating myself on how certain things work, gave me the ability to recover from things like soft bricks, bootloops, etc fairly easily. Without that knowledge base, I would have remained one of the herds of people who flame devs, blaming them for bricking my device(s)…you know, all those people we all love sooooo much, lol. In any event, cellzealot, I hope I understood your post correctly, and thank you guys (all of you) for continuing to be progressive and adaptive, in making a lot of people's Android experience the best it can be. :)
[Motorola Droid 3] WugFresh:
I agree with you that its a roundabout way of going about it, and I have tried doing exactly what you suggested regarding examining the update.zips but my knowledge is limited on that front... I assumed it was just mounting the system wrong or something of the sort. I didn't try very hard because I have no device to test it on.. and aimlessly posting betas for others to test is tedious.

That said, I really like coding in autoit.. and it seems like it would be entirely doable.

My goal was not only to have the script automatically configure the moto drivers, .net, radiocomm, and then change the values... but also have it store the users original values to a txt or dat file so that I could create a one click restore to stock option too...

The final interface would have two buttons, patch and unpatch.

Regarding getting in trouble, I am not selling it, nor am I including radiocomm in the original package. The only thing I am sketch about is the few lines of code I would wtite that would pull the radiocomm file from a third party site and possibly hash check it.

However that said.. I could easily leave that step up to the end user and just have them put the file in a "radiocomm" subfolder or something.. or have them point to it through explorer..

Creating an autoit script is entirely legal.

Regarding the tethering debate, I don't want to have it either.

I understand your reasons for not wanting to do it.. but my stance on programming in general is that its sole purpose is to make things easier/more accessible to those who are less knowledgable.. hence the reason we have bubbely guis rather than just terminal cmd's...further more if a program is made correctly it actually tends to make things safer because it eliminates end user error via automation.

I would argue that posting this is more dangerous than what I am proposing or publishing new flashable zips. The only thing this does is act as a deterrent to those less knowledge... which seems to be what you are advocating for...but to me that's unfair and backwards. My belief when it comes to development is that it should always be done with the noob in mind. And TBH does that all the time. With all your AIO files, pre rooted zips.. the list goes on. You guys are great at this.

I think the real issue has nothing to do with TBH's fear/hesitance of making something complicated, easy.. and has everything to do with indirectly enabling/helping people to violate their TOS. And if that's the case.. which I think it is, I don't blame you one bit.

I guess my moral compass is just less bound than yours on this one. As long as I am not legally responsible... I just like making things ... especially in AutoIt.. lol. Its honestly more for the challenge than the outcome.

To be clear, I mean no offense, and totally respect your stand point. I have no interest in causing drama or making an unwise decision.. I just like coding things in AutoIt, and the fake feeling of 'hacking'.

Please feel free to hit me up via PM if there is something I am not getting/missing.

{{ WugFresh }}
[Motorola Droid 3] cellzealot:
All good points and good questions Wug, sorry I have been too busy to get back to you and respond appropriately.

The best thing to do would probably be for me to start a thread dedicated to RadioComm and the NVM and explain how it works to help you understand.

I could just say that i am old and wise and you are young and...well...fresh, but that wouldn't do it justice. ;)

Then we can discuss why all of this is really legacy knowledge for the most part, because 4G LTE devices are all SIM based authentication, and the Qualcomm NVM for the CDMA/EvDO is controlled by the SIM and written to by the LTE radio, rendering all of this meaningless because any modifications are overwritten or ignored entirely.

That is where all of this is headed and the security regime is only destined to get tighter.

But in the meantime, it might be a productive and interesting topic! :D

Suffice it to say that we have been there and done that and we have paid severe consequences for it, including having our app removed from the market.

It has everything to do with this being a packaged theft of services hack and we were extremely apprehensive about releasing it publicly before it was even created. So much so that we didn't release it for several months after we first made it into an update.zip installation.

The zips have nothing to do with root and mounting etc. which all apply to the AP layer. This is directly editing the radio parameters via the tcmd device interface with RadioComm or in the case of the zips it is using Motorola's own updater_binary that is required for writing NV parameters for OTA updates and giving it a properly configured tcmd string for the NV write.

All that is required is to take to payload string from the updater-script in our DX zip and package it with the updater_binary for the D3...that simple.

The string is identical because the NV Items are the same for all devices.

The tricky part is configuring the tcmd string...which we already did! ;)

Are we having fun yet?
[Motorola Droid 3] bgdwiepp:
Firstly, this is not entirely on topic.

Secondly, I'm not extremely versed in how android works, but I know enough to get by.

I have always been somewhat curious about how a locked bootloader impedes further modification of an android system, I understand that it has certain security requirements, such as requiring updates to be signed before applying.

My specific point of curiosity comes from the following thoughts;

The further configuration/hardware control for the(beyond the radio chipsets' nvm) radio is stored in a partition on the device, radio.img?

Does the bootloader check partitions after they have been updated/flashed, eg, at boot, and thus additionally, once you have reached init is there anything in place that prevents you from modifying partitions? (eg, DDing the radio partition)

If there is something in place, is it possible to essentially symlink a partition to emulate the original radio partition, possibly during 2nd init?

By all means, correct me, as most of my knowledge on this subject(mostly) is simply conceptual and not practical, I just thought this would be interesting food for thought.