yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] shenye:
I'm starting off trying to use Odia's method on nv_data.bin. Haven't been able to find the 5 sets of hashes I need to brute force. Also, the file is not in /efs on the Galaxy Nexus, it's in /factory.

If you would like to help, I've attached the file I'm working on. To be honest, the salt has probably been changed to prevent this method from working :(
[Samsung Galaxy Nexus] trojjanhorse:
I've been tinkering with the .bin file myself and no luck... i think i may have to buy the code after all. I would much rather pledge my support to a dev who finds a way around this.
[Samsung Galaxy Nexus] bluejet07:
Hi all,

I have a galaxy nexus which is locked to a specific carrier. I managed to have it rooted and backed up with clockworkmod. I also was able to obtain the unlocked code from the carrier after much difficulty. Vodafone are just really painful.

Anyway, enough of the backstory. The process I carried out to discover something that might help you guys to find the 8 digit pin lives in the /data/radio/nv_data.bin file.

After restoring the rom before the unlocking state , I had to see what the state was state of the files before and after the unlock. I did this many times, until I found that file

was changed, (after greping for timestamp differences etc). As well, I've noticed that when I restored to a backup that had the network unlocked, it would just work when the sim of the other carrier was used. So I assume that there was some files that clockworkmod was restoring which made it unlocked. Who knew that.

When comparing this file before and after the network unlock,

(hexdump both files and did a text diff).

I've noticed that the unlock nv_data.bin had address 0180060 to 0180080

0180060 ffff ffff ffff ffff 35ff 3530 3330 3523

0180070 3530 3630 ff23 ffff ffff ffff ffff ffff

0180080 ffff ffff ffff ffff ffff ffff ffff ffff

removed from the unlocked nv_data.bin file as well as

0181460 ffff ffff ffff ffff 01ff 0000 0000 0442 changed to zero, i.e.

0181460 ffff ffff ffff ffff 00ff 0000 0000 0442

So maybe this is the addresses you can use to unlock your phone or use Odia's method to find the 8 digit code. Or you could just remove these bytes and set that flag to 0 and I assume that will unlock the phone as well.

I was planning to look at Odia's work and see what he used for obtaining the code.

So I see if I have time to look into this. But feel free to let me know if you guys get ahead of me.
[Samsung Galaxy Nexus] wilsonlam97:
Would it work if you just reflash the radio when you unlock the bootloader?
[Samsung Galaxy Nexus] bluejet07:
I've flashed different radios before, but I haven't checked flashing the radio and checking this file. However, I think that is unrelated since the radio firmware remains the same when I restored different versions of my clockworkmod backup and since I can relock the network pin by restoring a early image of the rom. It is probably unrelated.

Anyway, this method will assume you have root privileges. I was more concerned with finding how how to obtain the pin based on these hashes.
[Samsung Galaxy Nexus] Odia:
Method is the same, even the HASHes are in the same location, the nv_data from the OP has the new CRYPTED HASHes like the later SGS2 models, but simply flipping the FLAG @ 0x181469 will work for making unlock without knowing the code.

You could also make it same like a factory unlocked nv_data but I'll let you compare those and work out the method if its something you really want to do but if its just to unlock I have given all the info you need.
[Samsung Galaxy Nexus] bluejet07:
Yeah, so my diff confirms that. Cool as we already establish that.

But finding the code was really my goal. You know, for people who like revert back to stock but knowing the code.

So it is using some new encrypted hash like the later posts in the sg2 posts. So we have no idea how to brute force it? Yeah I had a look at all your posts and came to the conclusion it looks encrypted differently.

Oh well, maybe in time we can find a way to decrypt it.

Thanks for the reply!
[Samsung Galaxy Nexus] shenye:
Odia, any chance of a request into a bit of research into this? I can provide you with my locked nv_data and my unlock codes. I don't think my nv_data has been updated though as I need to reunlock everytime I wipe...

I assume they're using a salt that's no longer 0000000000000000, so this might be able to brute force the salt string they're using?
[Samsung Galaxy Nexus] jacobtc:
Would be very interested in knowing how to sim unlock the SGN!
[Samsung Galaxy Nexus] Roman2K:
Add me to the list :). Thanks to shenye, bluejet07 & Odia for working on this.
[Samsung Galaxy Nexus] Mutantz:
Which program can edit bin-file?

Where is this file placed?
[Samsung Galaxy Nexus] sitajony:
Unlock your Galaxy Nexus whenever your want :)

Hello, I've bought my Galaxy Nexus on december, 2 weeks later I've finaly found how unlock my phone :) I live in france and here we've to buy code and it's very expensive...

"I've made" a Batch script running only on Windows OS but we can see that is a Shell code... (In fact this come from a website in japanese without help and no choice so I've created this batch script)

After downloading, edit it and press CTRL+H then type in first field this:

"C:\Program Files (x86)\Android\android-sdk\platform-tools\adb.exe" and type the ADB path on your PC on the second field. (Keep this if it's the same path)

PRESS CTRL+S and run it...

The first question is:

Restore? (Answers: oui=yes, non=no)

Type "yes" only if you've already tried to unlock and it didn't work...

Finaly wait few minutes and in the last question, you'll can directly reboot your phone without touching your phone :D

Please tell me if there're problems or if you want ask me some questions...

Good luck!
[Samsung Galaxy Nexus] Roman2K:
@sitajony

Thanks a lot for contributing this Window batch script!

However, I think it's a bit of a mess in there (repetitions, some useless RW remounts, and world-writable permission settings, deletions of files in / that weren't created in the first place). Anyone willing to run it ought to double check every single line beforehand.

From what I understand, the core of it boils down to something like this:

$ echo -en \\x00 > tmp00
$ dd if=/factory/nv_data.bin of=tmpff bs=1 count=30 skip=16
$ dd if=/factory/nv_data.bin of=data1 bs=1 count=1572969
$ dd if=/factory/nv_data.bin of=data2 bs=1 skip=1572999 count=5090
$ dd if=/factory/nv_data.bin of=data3 bs=1 skip=1578090
$ cat data1 tmpff data2 tmp00 data3 > nv_data.bin
$ md5sum nv_data.bin | tr '\n' 'X' | sed 's/ .*//' > nv_data.bin.md5
# cp nv_data.bin{,.md5} /data/radio/

So this /factory/nv_data.bin is being split and the pieces re-arranged. Do you have details as to what is being done exactly? And / or the link to the original script on the japanese site?
[Samsung Galaxy Nexus] cristian1975:
Don't know what is doing, but works. But backup first EFS folder, factory ...

@sitajony - I didn't had cp command in my "nexus" shell, but managed with RootExplorer and rest of the code, thanks.
[Samsung Galaxy Nexus] gaglax:
i am planning to switch from stock to cyanogenmod9.

so is it safe to use the script and then flash CM9?

thx
[Samsung Galaxy Nexus] jacobtc:
You use it after flashing the ROM, it uses ADB...
[Samsung Galaxy Nexus] sitajony:
Sorry, I can't answer immediately, I don't remember the website address sorry...

@gaglax Don't run this code, run the batch script else you'll get errors, there're some others lines needed...

You've to run it after any rom flashed if you've deleted the "/data" folder in ClockWorldMod menu...

@Roman2K

Yes it's splitted, we get bytes that we need without informations about unlock state and then write all in "nv_data.bin" file to unlock folder...

I've also noticed that I've some problems with my network, sometime I'm in offline mode, someone else have this problem too?
[Samsung Galaxy Nexus] gaglax:
ok so i flashed cyanogenmod 9 kang.

then replaced the path .. but it always says permission denied.

so i went to settings/debugging and enabled root, adb over networks.

now i cannot get into the phone via adb:

C:\>"c:\android-sdk\platform-tools\adb.exe" devices
List of devices attached
000000000000 device

C:\>"c:\android-sdk\platform-tools\adb.exe" shell

it just stays there ..

ok i think that adb over network seems somehow broken in the latest kang from here: http://xdaforums.com/showthread.php?t=1398495
[Samsung Galaxy Nexus] Roman2K:
@gaglax

"su" asks for a password before executing a command (or shell) as another user. If "root" doesn't have a password, I believe it prints the "Permissions denied" error you're getting.

To run commands as root with "adb", you should rather start with running:

$ adb root

This will restart the ADB client process in the background (sort of bridge between the "adb" command and the phone) with root privileges. For that, your phone must be running a build with root access, like a development build (build type full_maguro-userdebug).

Then, to run commands more conveniently than invoking "adb" every time:

$ adb shell

@sitajony

OK, thanks for the clarifications.

I haven't tried the chopped up + reassembled nv_data.bin yet. I'm all new to Android and even newer to the SDK. Really good stuff, high quality documentation, but I'm going step by step before attempting anything I don't understand fully.

I've tried loading a factory image, thinking that since it replaces the radio flash partition, it would load a clean version of whatever it is the carrier tampered with. Didn't work, still asks for a network unlock code after entering the PIN code.

Next, I'll try your nv_data.bin manipulation, but first I'm building a -userdebug to gain root access.
[Samsung Galaxy Nexus] gaglax:
cool that was it ..!! :D

i restarted with:

adb root

then used the script.

somehow there where some error messages but the galaxy nexus is now sim unlocked.

thx for your help ;-)
[Samsung Galaxy Nexus] Roman2K:
Ha, excellent! Thanks for sharing your experience :D. Now let's see if you encounter sitajony's offline mode problems.
[Samsung Galaxy Nexus] Midget010:
I was wondering if anyone has had any success with this. I'm getting a galaxy nexus locked to three and wanted to know if this would work before buying a code.
[Samsung Galaxy Nexus] jacobtc:
Yes it worked for me, however I'm getting some weird disconnects while talking on the phone sometimes, and when I look it got zero bars, but it quickly jumps back to 3 bars signal again, don't know if it is this unlock that does it, or just some bad reception in my area...
[Samsung Galaxy Nexus] gaglax:
ok just to let you know.

since the kang of cyanogenmod9 is not ready for daily use .. i flashed this rom:

http://xdaforums.com/showthread.php?t=1402341

it seems the sim unlock is gone .. i am asked again to enter the sim unlock code.
[Samsung Galaxy Nexus] Roman2K:
Worked for me as well. Haven't tried calling anybody though, so I can't comment on dropped calls yet.

By the way, I think the original script is on this page.

Also, the unlock is not permanent. If /data is wiped clean, the modified nv_data.bin (and .md5) have to be rebuilt and placed back in /data/radio.
[Samsung Galaxy Nexus] gaglax:
ok, i will execute the script again.

can i just backup and restore this folder somehow ?

sometimes when flashing roms it is required to wipe the data.
[Samsung Galaxy Nexus] Roman2K:
I don't know. I wouldn't do that, personally, since the fact that /data needs to be wiped indicates that files in /data need updating, likely including /data/radio.

I think it would be safer to restrict the scope of the backup/restore to just /data/radio/nv_data.bin{,.md5}.
[Samsung Galaxy Nexus] juju2lose:
Great job

Thanks for your work guys, i'm sure you'll find a permanent way to unlock the phone soon.

Thanks agaiN.
[Samsung Galaxy Nexus] Roman2K:
I've run the guts of the same script (by hand), so basically the same method. Though the unlock is indeed persistent across reboots, the fact that this method has to be applied again after a wipe doesn't qualify it as "permanent" to me.

There are still traces of the lock somewhere.
[Samsung Galaxy Nexus] David Horn:
The phone will re-lock itself after a hard reset even if you use a genuine unlock code from the operator so this is a reasonable solution.
[Samsung Galaxy Nexus] efrant:
Ok, but that doesn't mean that a permanent unlock solution can't be found.
[Samsung Galaxy Nexus] Roman2K:
Oh, then it's more acceptable. Thanks for the info.

Yes, there's got to be a way, given that:

There exist retail Galaxy Nexuses which are not locked at all.

We have full root access, the sources of the whole OS and its SDK. Even drivers are open-source except for these two black sheeps -- granted Samsung's GSM is one of them :rolleyes:.

Isn't there a way to make any Nexus the same as those which are not locked? By loading the exact same firmware at the correct place(s) once and for all -- or something?
[Samsung Galaxy Nexus] efrant:
Your last statement is not true. I don't have much experience with the Samsung Galaxy Nexus, but I can tell you for the HTC Nexus One, there are some things that you could not do just by flashing. For example, While everyone says that the Nexus One came with an unlockable bootloader, that is not entirely the case. "Unlocking" the bootloader only gave you a partial unlock, not a full NAND unlock. Sure you could flash unsigned ROMs and recoveries, but you could not flash unsigned bootloaders or radios. I suspect this is the case with the Galaxy Nexus.

Moreover, on the Nexus One, you do not have access to the radio NVRAM, which contains that lock flag. In order to change any of the lock flags there, you needed a special SIM card, or a SIM emulator like an XTC clip. Again, I suspect something similar will be required for the Galaxy Nexus to remove any locks...
[Samsung Galaxy Nexus] Roman2K:
@efrant

Thanks very much for the informative correction.

I'm a total newbie so please bear with me if it's a silly question:

When you say we don't have access to the radio NVRAM, what's nv_ram.bin (in both /factory and /data/radio) compared to the "radio NVRAM"?
[Samsung Galaxy Nexus] efrant:
I am no expert by any means - everything I learned, I learned from the knowledgeable individuals in this community.

Having said that, my understanding is that (on a Nexus One anyway), there are certain lock flags (SIM lock flag, security lock flag) that can only be set with access to the radio NVRAM, which is a separate chip, i.e., it is not part of the NAND flash chip nor the RAM chip. The NVRAM can only be accessed by using a special SIM (or emulator, e.g., XTC clip) to set the flags.

I would assume Samsung has something similar, which is why every time you flash or hard reset, your device relocks -- because you haven't actually changed the SIM lock flag, you are just sort of bypassing it.

Again, all this is just my understanding based on various things I have read here.
[Samsung Galaxy Nexus] gaglax:
ok i re-unlocked my device since lunch (10 hours) and experienced the network drop at least 8 times which you described.

HSDPA is gone for about 1-2 minutes.
[Samsung Galaxy Nexus] Roman2K:
@efrant

OK, thanks for these details. Definitely helps in wrapping my brain around all this :D.
[Samsung Galaxy Nexus] rabug:
Anyone notice something about IMEI number? I.e. like missing IMEI after ran the script?

I'm asking because are comments about it on 2chan's thread and on original script (japanese)...
[Samsung Galaxy Nexus] gaglax:
I don't think I have this problem.

It can see the IMEI number in Settings/About Telephone/Status.

However the network issue not only affects HSDPA but GSM as well.
[Samsung Galaxy Nexus] ptisam:
Help ! Since I've used the script, my gsm Galaxy Nexus doesn't find any network anymore. I've already tried to flash the stock rom (the maguro one, bootloader, radio, system, recovery, wipe date...) without any effect. Don't know what to do else now. Even with a total stock reset the problem is still present. It seems like the phone alternates between airplane mode off and on, without any control on it on the settings. When it try to search the networks it fails. Even emergency calls are impossible ! It tells me "out of service area". Any idea for a solution for that =/ ?

Sorry for my english ^^
[Samsung Galaxy Nexus] Roman2K:
@ptisam

Since you used the script as-is, it should have backed up the original nv_data.bin and .md5 in /mnt/sdcard/nv_data_mod/factory.

You can always restore them from there to /data/radio and /factory.

Should you do that, you would have to find another unlocking solution though :).
[Samsung Galaxy Nexus] ptisam:
Oh, I've already wiped the data =( but I finally found another solution. The file /factory/nv.log was renamed as .bak and it seemed to be the issue. Since I've renamed it, everything works fine...

Yeah indeed for the unlock, I don't really understand why it didn't work... It seems to work with other people with gsm galaxy nexus =/ anyway, I'll wait until i receive the unlock code from my carrier, it just a question of a few days

Thanks very much !
[Samsung Galaxy Nexus] soudara:
work but lose signal

yes it's working but lose my signal gsm and hsdpa 2mn every 15minute please fix

ty
[Samsung Galaxy Nexus] ctkhaled:
ohhhhhhhhhhhhh

thank's it's work

but still a big problem, the phone enter in aircraft mode every 5 min, even in call

the gnex is sim unlocked :) but unusable :mad:
[Samsung Galaxy Nexus] ctkhaled:
i reflash my gnex with an aosp rooted rom a i unlocked it again. but still the phone enter aircraft mode for 1 or 2 minutes randomly.

please help with this, i revert to my old nokia :confused:
[Samsung Galaxy Nexus] gaglax:
did you execute a full wipe, factory reset, davlik cache, ..?

attached you will find my original files.
[Samsung Galaxy Nexus] ctkhaled:
Thank you gaglax

yes i do all the wipes,

pls confirm the fils attached are the original unlocked or locked?

and have a gsm probleme after the unlocking procedure

ty
[Samsung Galaxy Nexus] gaglax:
those are the files from the original script which were backed up in /mnt/sdcard/nv_data_mod/factory.

the changed files can be found in /mnt/sdcard/nv_data_mod/unlock.

backup your current files as well:

/data/radio/nv_data.bin.md5

/data/radio/nv_data.bin

good luck ;-)
[Samsung Galaxy Nexus] ArcanaXVIII:
So you confirm your script is working for you without the data drop on a GSM GN?

If so, I'll give it a try. ^^
[Samsung Galaxy Nexus] gaglax:
No it was just the original file from my locked (A1 sim lock) galaxy nexus phone.

I am not even sure if it will work for him.

I have the GSM/HSDPA drops as well, but I can use the phone only with the hack ;-/
[Samsung Galaxy Nexus] ArcanaXVIII:
Applied the patch, for now it seems stable.

But then again, I have ****ty reception at home with my new carrier, so tomorrow will be the real test to see if I notice any drop.
[Samsung Galaxy Nexus] ctkhaled:
The hack works just fine. but after that, i have trouble with gsm and cdma conexion, randomly disconection, the phone says 'can't do a call when in aircraft mode'.

a fix will be awsome

thanks +++ donate ' else to bye a code' lol
[Samsung Galaxy Nexus] gaglax:
just to let you all know.

i obtained a unlock code and deactivated the sim lock and i still had the network drops regarding gsm and hsdpa.

so i flashed a new modem: XXKL1 from here http://xdaforums.com/showthread.php?t=1444288

this seems to be stable so i am not sure if the instability is really caused by the hack.
[Samsung Galaxy Nexus] narunas:
I am in US, got Ireland vodafone locked GN last week.

did all the expected things -unlock boot loader, root, ClockworkRecovery, flashed several new images for radio, OS , etc..

no go - the dreaded screen is still up - curiously though - after paying several "unlock" providers - none of them even came through with the code, all had to refund.

Looks like the solutions at least is understood in this thread - will eagerly await for something that is confirmed functional.

-- or if will get desperate - will try the script - I don't like to get to windows for that.

Thanks in advance ya all!
[Samsung Galaxy Nexus] aviv2001:
help!!

why is not work?!?

plz help me!!
[Samsung Galaxy Nexus] aviv2001:
???? help!!
[Samsung Galaxy Nexus] gaglax:
please add information and describe in detail on what you want to do or the steps you already did.
[Samsung Galaxy Nexus] aviv2001:
after my nexus ask to "network sim pin code":

I do unlock bootloder,root and change to customer rom...after all this i use the script "Hack NV.zip"...and it still ask to "network sim pin code"..

sorry my bad English!

Tanks!
[Samsung Galaxy Nexus] Oby One:
The cp not found error can be solved by installing busybox.

That did it for me!

Thanks...the fix worked fine on my (previously) locked vodafone nexus galaxy.

yeey :)
[Samsung Galaxy Nexus] tndb:
Since there havent been much more discussion going on and ive recently gotten a simlocked nexus myself, I decided to try out this "hack" and I got the same issue as most with network calls dropping and data dropping and swapping over to roaming and just going nuts.

I decided to try out another modem so I flashed XXKL1 from http://xdaforums.com/showthread.php?t=1444288 and it has just been working flawlessy for two days now and I also pushed it alot with having webradio streaming nonstop and surfing the web, making calls etc and it didnt drop once and the following day when I was out working passing by different cellstations etc I had the same experience as home.. NO DROPS, so this modem will also help users running old vanilla firmware etc. I think the kernel can screw it up a bit aswell since I saw some posts about ppl still having issues about it (with XXKL1) but that was with custom kernels instead of the one supplied from each rom.

I havent tried many roms as I went through quite some posts before I decided on one and I chosed Pauls 4.04 (from modaco http://android.modaco.com/topic/351...a-gsm-modaco-custom-rom-for-the-galaxy-nexus/) since it didnt had too much overclock and modified kernel bull**** which otherwise makes your phone unstable and messy and just creates other problems which takes time to find out where it comes from.

So for me I used the Galaxy Nexus toolkit to unlock and root phone, then I used the patch from this thread and after that I flashed Pauls Ir11 Beta 2 4.04 rom + XXKL1 baseband modem which has been working flawlessy. Always remember to clear data/system/cache and dalvik cache if you are coming from another rom/kernel to avoid strange issues and stay away from wierd kernels unless you wanna risk it ofc then go ahead and have a messy phone :)
[Samsung Galaxy Nexus] lilizblack:
Errors on script

Ive been trying the script by cmd and manually doing the commands. I get lots of no such file or directory doesnt exist. When changing locks on nv_data.bin works the md5 creation has lots of not found commands, and im still locked. Ive been reading the original code and the two scripts post here and I cant make out what is wrong? Why is not working for me?
[Samsung Galaxy Nexus] Parastie:
Can you post a log of the exact errors your getting? It doesn't really help unless we can see the exact missing files.