[Android Software/Hacking General [Developers Only]] josuesoto:
Tools Needed:

all can be googled and downloaded

- QPST 2.7 build 359

- QXDM 03.09.19

- CDMA WS 2.7 (ATTACHED)

- HTC Diag Drivers (ATTACHED)

Connect the phone via USB

On the phone dial ##3424# to enter DIAG mode

Install drivers if needed (on some systems it will find all the right drivers BUT the HTC Diag driver. For me I had to manually force it to take the x64 driver in Windows 7. Once you add the driver it functions perfectly.)

Open device manager and look for the device under "Modems" -> HTC USB Modem

Double click on HTC USB modem and go to the "modem" tab and note the COM port.

Open QPST Configuration

Click on "Ports" tab

If the port you wrote down is not here click "Add New Port"

Uncheck "Show Serial and USB/QC Diagnostic ports only" and your port should appear on the list.

Highlight it and click "ok" to add.

Close QPST

**** You have now established a connection with your device ****

Open CDMA WS 2.7

Under COM Settings (AT Mode) select your COM port for your device, leave baud rate at 115200

Click "Connect"

Click "Read" (This is not necessary but I do it to ensure I have a good connection to the device. The "read" output will display the phone information in the fields on the left. If you don’t see this information populate you have not established a connection with the device and need to verify your COM port settings and try again.)

Click the "Security" Tab

Under SPC make sure it is set to "Default (nv_read)" and click "Read"

It will display your SPC in the empty box. WRITE THIS DOWN for later!

Click on "SPC" button and click on "Send"

If you have done everything correctly you will get a popup that says "SPC is correct. Phone Unlocked."

Click "ok"

Close CDMA Workshop

------------------------------------------------------------------​

Open QXDM

Under "Options" on the main menu click "Communications.."

Set "Target Port" to your COM port for your device.

Click "Ok"

Click "View" on the main menu, navigate to New -> Common -> Command Output (this will open a black command prompt window in QXDM.)

in the "Command" text field at the bottom of QXDM type "RequestNVItemRead meid" and press enter.

Your MEID string will be displayed as fallows, copy this to notepad with your ESN.

22:25:40.971 meid = 0x00A10000053179FF

Minimize QXDM, we are done with it for a while.

Preparing your MEID and ESN values and flipping them

In Notepad take your ESN and MEID values and strip them of the 0x00's as follows:

MEID = 0x00A10000053179FF

Change to = A10000053179FF

Now flip the values as shown and add a space between every two values:

MEID Original = A10000053179FF

MEID Flipped = FF 79 31 05 00 00 A1

ESN Original = 81380CRA

ESN Flipped = RA 0C 38 81

Zeroing out your ESN and MEID values in QXDM

At this point if you followed the instruction QXDM should be minimized and still connected to your phone. Your phone should still be SPC unlocked and there should have been NO reboots in the entire process. If you did get a reboot you will need to rescan your memory addresses as they change when the phone is rebooted.

Maximize QXDM

Go to the file menu and select "View -> New -> Common -> Memory Viewer"

Change the drop down box next to "Rows" from 8 to 16

Now carefully copy a MEID or ESN address from your saved notepad file to the "Address" field and press enter. Example: 0x108D8FE0

Find your FLIPPED ESN or MEID address in the string and change ONLY those values to 00 (zero's)

DO NOT CHANGE ANYTHING ELSE EVEN IF IT IS CLOSE OR OFF BY EVEN ONE DIGIT!!!! (You may permanently damage your phone!)

Once you change the MEID or ESN to zero click "Write" The values will change from red to blackindicating they have been written.

Do this for all the rest of your MEID and ESN values

(LOCATIONS CAN BE FOUND IN .ZIP ATTACHMENT BELOW)

Verifying you have Zero'd out your MEID and ESN

Bring the Command Output Window back to the front.

In the Command field at the bottom type "RequestNVItemRead meid" it should display:

22:25:40.971 DIAG TX item:

22:25:40.971 meid = 0x0000000000000000

22:25:40.971 DIAG RX item:

22:25:40.971 meid = 0x0000000000000000

If your MEID is zero'd out proceed to step 4.

If your MEID is not zero'd out. Don’t bother proceeding to ESN you MUST zero out your MEID before you can change your ESN.

* If your MEID did not zero out and you used all the address locations you could possibly find by scanning I highly suggest going through the forums and trying all the MEID addresses people have submitted. I will also include a master list of all the ones I can find at the bottom of this post.

In the Command field at the bottom type "RequestNVItemRead esn" it should display:

23:39:40.442 DIAG TX item:

23:39:40.442 esn = 0x00000000

23:39:40.442 DIAG RX item:

23:39:40.442 esn = 0x00000000

Now hold power button on Evo Shift and select Airplane Mode.

Disconnect QXDM by clicking comunications tab then ports. Change the port to DISCONNECTED.

DO NOT CLOSE QXDM!

Go back to QPST Configuration and click on port your phone is on. Then click Disable to disable the port.

Now restart your phone but DO NOT unplug it from usb cable.

When it comes back on dial ##3424#

Verifying your MEID is now Zero'd out after reboot

Go to QPST Configuration and enable the port your phone is on.

Go to QXDM and click comunications tab, then ports.

Change the Disconnected to the port your phone is on.

In the Command field at the bottom type "RequestNVItemRead meid" it should be zero'd out.

In the Command field at the bottom type "RequestNVItemRead esn" it will have reverted to the original ESN.

This is expected!

Now go back into "Memory Viewer" and zero out all the ESN addresses again.

Once you have zero'd out all the ESN addresses verify the ESN is zero'd out by typing

"RequestNVItemRead esn" into the command field with the command prompt brought to the front.

Regardless of if the ESN is completely zero'd out or not proceed to the next step. This is how you uncover the hidden ESN memory entries and any locatons that may have changed from the reboot!

*Do Not disconnect the phone or reboot it!

Try to write your MEID by using the following command "RequestNVItemWrite meid

0x00A100000XXXXXXX" (Replace A100000XXXXXXX with your Boost MEID HEX)

If it succeeds it will show:

00:11:53.415 DIAG TX item:

00:11:53.415 meid = 0x00A100000XXXXXX

00:11:53.415 DIAG RX item:

00:11:53.415 meid = 0x00A100000XXXXXX

Changing your MDN and MSID

Now that your phone has been repaired you need to update your MDN and MSID to reconnect to the network for voice and text messages.

Turn on the Phone

Dial ##[your MSL]# to allow you to enter EPST. Your MSL should not have changed

from the one you noted earlier before the MEID repair but If it did go to the steps above on how to find your MSL with CDMA WS 2.7

Chose "Edit Mode"

Edit your Mobile Directory Number (MDN) and enter the one for your wireless network

Click "Ok"

Edit your MSID and enter the one for your wireless network

Click "Ok"

Press the "Menu" key and select "Commit Modifications" and the phone will reboot.

Once rebooted try to dial out and send yourself a text message!

LET ME KNOW IF THIS WORKED FOR YOU! THANKS!