[Click Android Development] weinerwad3000:
I think this tutorial is long over due. There are guides out there for individual basebands but if you don't want to go searching and want to learn how to do it your self hopefully this guide can help. If it does, don't forget the thank you button.

Your first step obviously is to get all the drivers you need to hook your phone up to CDMA workshop, so download any diagnostic drivers you may need. One other thing you need is some type of hex editor. Winhex works great. You can get it here.

http://x-ways.net/winhex/

Once that's done we can move on.

1.) Open up cdma workshop and connect your phone and then click read. Proceed to the security tab and enter your spc code and send it to the phone to unlock it.

2.) Go to the memory tab and click start under memory scan. Just leave the fields the way they are.

you should get something like

Scanning memory for readable areas:

Unreadable area from: 0000:0000

Readable area from: 00FA:0000

Unreadable area from: 0100:0000

Readable area from: 0109:0000

Unreadable area from: 01DC:0000

Process is stopped at: C000:0000

You shouldn't have to sit there through the entire scan. After you get the two readable areas and two unreadable areas you can stop the scan, but it's not mandatory.

3.) Now for the tricky part. I'm not sure if this is how you figure out the number of bytes you need but it works fine for me. The memory is readable from 00FA:0000 to 0100:0000 so we take the number 0100:0000 and subtract it from 00FA:0000 and convert it to a decimal. To do this use the calculator tool in Windows. So open the calculator and click view and select programmer.

Now punch in 1000000. (The first zero doesn't matter, the same goes for the other address.) Then click subtract and punch in FA0000(of course replacing these addresses with the ones in your scan). Now when I hit equals I get the hex number 60000. To convert this to a decimal simply select dec.

As you can see I get the number 393216.

4.) Now in the memory / Eeprom area put in the number you calculated where it says bytes. Put in the first readable area in the start address field. Now click read and it will prompt you to save the file somewhere so go ahead and do that.

5.) Now take your MEID number and put it in pairs of two then reverse them. For example if your MEID is A1000067452301 pair it like so

A1 00 00 67 45 23 01 and reverse it like so

01 23 45 67 00 00 A1 remove the spaces and you get 012345670000A1

6.) Open the saved file in Winhex and press ctrl, alt and x. This will bring up a window so you can search certain hex numbers. Put in your reversed MEID without the spaces.

Click OK and it will take you to the first MEID it finds.

The address to the left of my MEID is 0000C590(or just C590) and the column for the beginning of my MEID is 4. Add 4 to C590 and you get C594. To get the first MEID address take the number you start the scan with(mine was FA0000) and add C594 to it. I get FAC594. This will be your first MEID address. Write it down and move on to the next. If you press ctrl, alt and x and hit OK it will take you to the same address you were just at so what I do is change one of the numbers and then search again like so.

I changed the first pair to 00 so I can continue searching for MEID addresses. Continue this process for the rest of this file then you must do step 3-6 with your second readable areas. Mine again was 0109:0000 - 01DC:0000. The second readable area takes a very long time. My bytes ended up being 13,828,096.

7.) The last thing I did was do the entire process again only I put the phone in airplane mode. This may or may not be necessary. This same process can also be used to find your ESN locations. Just search the same files but put your reversed ESN in the search window in Winhex.:D:D:D:D:D:D:D:D:D

Overall it is a very time consuming process but if you do everything correct it can save you a lot of time as opposed to looking up addresses someone else has posted. I have tried in the past and people with the same baseband had completely different addresses.

I hope this helps and don't forget the Thank You button if it does.