yashsingh1/xdaforums huggingface dataset:
[Galaxy S III Q&A, Help & Troubleshooting] kpla46:
I know too this message unfortunately aiduxxx !

I also can't wait
[Galaxy S III Q&A, Help & Troubleshooting] jonny68:
Look forward to Odia's tutorial on unlocking :)
[Galaxy S III Q&A, Help & Troubleshooting] is350:
Do you think an unlock will be available for the North American variants (United States) that has the S4 processor and 2GB RAM?
[Galaxy S III Q&A, Help & Troubleshooting] Woolios:
+1 As I'm with Telus and they aren't above to prickery like locking a phone down tight. Good thing I've been around since the first SGS and know the development here is AWESOME!!!
[Galaxy S III Q&A, Help & Troubleshooting] m33ts4k0z:
Well as of an update, Odia is still looking into things about our phone and he is trying to make the process as simple as possible for us.

We might have another teamviewer session later today but its not sure. When he is ready with an easily executable solution he will be posting the guide.

Also I would ask for another volunteer since my phone got water on the screen yesterday and it run through the button onto the screen so now my screen is dark dark green although it does work.

On Tuesday I'm sending it in for repair and Odia will might need another person to run his tests. Reply to this thread please so I can notify him.
[Galaxy S III Q&A, Help & Troubleshooting] iphdrunk:
patching nv_data.bin still works with unbranded firmware

I am also looking forward to Odia's tutorial, specially since hashes seem to be encrypted in the SGS3, and obtaining the unlock codes is not as straightforward as it used to be in other models.

In particular I am interested in how to use the modem.bin to decrypt the hash, it looks like one needs to use the SGS3 libraries to request the decryption of the hash, getting the key, etc.

However, It is still possible to use the method that implies patching the nv_data.bin file. Check Oida post on SGS2

http://xdaforums.com/showthread.php?t=1064978

In SGS3 the offsets are the same, although not the was to store the hashes (hash lengths are 32 bytes, encrypted)

so the command

ighashgpu.exe /h:XXXX /t:sha1 /c:d /max:8 /min:8 /salt:0000000000000000

will not work (ighashgpu is a passwd recovery tool that can be downloaded)

I was not sure whether it was sha256, a different salt, or.. :?

In later posts within the aforemention thread, Odia stated that the hashes are encrypted (there seem to be that the hashes are 20 byte long, padded and encrypted with a block cyper like aes?)

AFAIK, there could be 2 methods:

1.- non intrusive, involves getting the nv_data.bin to your PC, use an hex editor; go to the offset, get the hashes, decrypt them and use a software to a dict attack with all potential 8 digit passwds. As in later sgs2, the hashes are crypted, 32 bytes long and we cannot use simple ighash them

2.- the same method as the SGS2 (this is just a brief summary, search the forum for a detailed explanation, I also changed the code at offset 0x180069 - although this may not be needed.)

backup yor SGS3 /efs folder (!);

copy the nv_data.bin to your PC

use an hex editor to locate the offset, reset the 0x01 flag to 00.

remove /efs/nv_data.bin /efs/nv_data.bin.md5 (I also deleted the "old" files)

copy your patched nv_data.bin file back to /efs

chmod 755 /efs/nv_data.bin

chown radio.radio /efs/nv_data.bin

reboot

(you can do this either with adb shell or directly in the terminal).

Method 2 has worked for me, you do not need to create the md5, although you need root, su, busybox (to use cp rather than dd). The first time I tried the method it failed, and I was prompted to enter the network unlock code on reboot, so I clicked on "dismiss". It seems that the patched nv_data.bin method does not work with a "branded" firmware (at least in my case), so I had to install a unbranded firmware first (with odin, following intratech explanation). After installing the unbranded firmware, copying the patched file and rebooting the phone, the phone is unlocked as per *#7465625#

Firmwares, modems, etc can be downloaded from

https://androidfirmwares.net/PhoneFirmware3

https://androidfirmwares.net/Modem3

also check intratech threads

Check your CSC codes etc.

http://ykkfive.blogspot.com/2011/11/samsung-csc-code-reference-3.html

You can check your current CSC code with *#1234#
[Galaxy S III Q&A, Help & Troubleshooting] m33ts4k0z:
I don't have the knowledge to understand what Odia did but he hexed the nv_data.bin and he rebooted the device. After that he asked me to input 00000000 as the code and it worked. It actually took him something like 15 mins to figure it out.
[Galaxy S III Q&A, Help & Troubleshooting] ludwiglaisne:
Maybe you forgot HELROZ !
[Galaxy S III Q&A, Help & Troubleshooting] kpla46:
No news ?
[Galaxy S III Q&A, Help & Troubleshooting] is350:
Any news about the unlock and whether Odia will try to find the unlock for the North American versions (S4 processor). Thanks!
[Galaxy S III Q&A, Help & Troubleshooting] HaruSoul:
Why are you guys asking for an unlock for a phone that isn't even out yet? Do you think he is some kind of wizard?
[Galaxy S III Q&A, Help & Troubleshooting] jonny68:
errrrrr the Galaxy S3 has been out over a week now, have you been living under a rock or something :eek:
[Galaxy S III Q&A, Help & Troubleshooting] Totòòò:
:D
[Galaxy S III Q&A, Help & Troubleshooting] bioswe:
first locked then suddenly unlocked

Hi,

I got my SGS3 (my first android :) ) from Tele2 sweden. I tried it with a Telia SIM and then it asked me for a unlock password after I enterred PIN. I also checked *#7465625# and Network lock was ON.

Today I was reading this thread because I wanted to unlock my sgs3, I enterred *#7465625# again and know "Network lock" was set to OFF? How did this happen?

I tested with the same Telia SIM again and wasn't asked for unlock password. I got reception and could make calls. :)

What I have done with my sgs3 from begining until today is:

rooted > omega v2 > omega v3 > update to Modem_I9300XXLEF > update to Kernel_I9300ZSALED
[Galaxy S III Q&A, Help & Troubleshooting] kobz1973:
Looks same for me ... on stock i had network lock ... now on Omega v3 and network lock shows off ... dont have another network sim to try though ..
[Galaxy S III Q&A, Help & Troubleshooting] SoulTerrox:
is your IMEI still the same? you can find it above the battery
[Galaxy S III Q&A, Help & Troubleshooting] ctai320:
Just to add and confirm that three in hk is unlocked. Used the code from the thread and everything is off.
[Galaxy S III Q&A, Help & Troubleshooting] bioswe:
Yes. it's the same.
[Galaxy S III Q&A, Help & Troubleshooting] mycso:
The solution: SmartSambox - Multi Flashing & unlocking Service tool for Samsung Phones

(i have not tried)
[Galaxy S III Q&A, Help & Troubleshooting] Sui77:
Anyone tried it already?
[Galaxy S III Q&A, Help & Troubleshooting] laporte2001:
Someone reckless enough to try ?
[Galaxy S III Q&A, Help & Troubleshooting] tlc77:
For me (S3 locked by the french operator ORANGE) i have just change the stock ROM by OMEGA V4 and network lock is still "ON"... Maybe i must perform the update of "Modem_I9300XXLEF" or "Kernel_I9300ZSALED" ? Someone have more information?

I have install this application but with no "HOW TO", i'm not able to run the process... I have not found an explanation of the software, weird ... :confused:
[Galaxy S III Q&A, Help & Troubleshooting] micke7:
ditto, but also I update Modem and Kernel.

Concerning "SmartSambox - Multi Flashing & unlocking Service tool for Samsung Phones", a box is required to operate. Software only is useless ;)
[Galaxy S III Q&A, Help & Troubleshooting] tlc77:
Ok thanks, this solution seems not work with all operators...

Thanks, that's what I thought...

I expect a guide ;)
[Galaxy S III Q&A, Help & Troubleshooting] iphdrunk:
Rooting and/or unbranding the phone is not enough to unlock the phone (necessary but not sufficient conditions). You either need the unlock code (provided by your carrier, if you meet certain criteria, usually at the end of your contract; or by some internet service that give you the code if you pay, provide country and carrier, and usually your IMEI) or, for some phones, you need to patch a binary file. For SGS2 and SGS3 the /efs/ folder contains the nv_data.bin. Patching that file works and unlocks the phone.

In older phones you could be able to obtain the network unlock code by getting the hash stored in the phone and "trying" all possible 8 digit codes. Recently the hashes are encrypted.

It is possible that, at some point, someone releases an app that patches the nv_data.bin. It is also possible to do it manually, with care, if you backup the file first.

It is documented in several posts, such as:

http://xdaforums.com/showthread.php?t=1064978

http://xdaforums.com/showthread.php?t=761045

In short: getting the hashes and running ighash.exe to get the code so you can enter it later does NOT work. Manually changing 0x01 to 0x00, the MCC/MNC to 0xFF 0xFF 0xFF 0xFF 0xFF may work in a rooted (ideally unbranded) phone. It worked for me, but there is a risk.
[Galaxy S III Q&A, Help & Troubleshooting] micke7:
And replace the files nv_xxx by files nv_yyy unlock a GS3?
[Galaxy S III Q&A, Help & Troubleshooting] m33ts4k0z:
Have anybody tried this? You can backup your nv_data.bin file and then try it. it wont harm your phone. If it doesnt work just restore your copy.
[Galaxy S III Q&A, Help & Troubleshooting] iphdrunk:
*if* you know exactly what you are doing *and* you have made a backup of the /efs folder (including the nv_data.bin), then i] replacing the nv_data.bin of the /efs folder (which is the partition 3 of the mmcblk device) with a modified nv_data.bin file, and ii] deleting the .md5 and the hidden .old files will indeed network (sim)unlock your phone in a rooted /(ideally unbranded) phone. The "new" nv_data.bin file must have been edited with an hexeditor so the lock flag is reset and the MCC/MNC has been replaced with 0xFFF...
[Galaxy S III Q&A, Help & Troubleshooting] judapa:
I can test Odia sim lock solution for i9300

I have one Galaxy S3 I9300 International Version locked, ready to help, I can test Odia procedure, and I can bring nv_data files and what else you need. Just let me know and I will answer inmediatly.

Cheers.
[Galaxy S III Q&A, Help & Troubleshooting] Iagogf:
Odia not going to take this tutorial??

Please.........!!! I need unlock my SGS3 as soon is posible.... :(
[Galaxy S III Q&A, Help & Troubleshooting] gcaperan:
Hi,

The nv_data.bin modification solution doesn't work for me, because when the .md5 file is missing, the system restores a backup of the nv_data.bin, and if I delete this backup, there is a secondary backup(nv_core), and If I delete this backup too, then the system generates the nv_data.bin with a default IMEI. In any case, the modified nv_data.bin is always ignored.

I think that a possible solution may be to find out how to generate the .md5 file. But it is not a normal md5 file(if you use a md5 generator, the code generated is different).
[Galaxy S III Q&A, Help & Troubleshooting] E:V:A:
Good thinking! Perhaps its not a MD5 but some other algorithm. The filename remains, for compatibility. Try to run your file through various other hash functions. Perhaps SHA-1?
[Galaxy S III Q&A, Help & Troubleshooting] Astrofrigo:
Does this method actually unlock the phone in the proper way? as in, wouldn't the tech service notice that those files were modified? wouldn't installing a new ROM lock it again? (although I assume not, if EFS folder doesn't change from ROM to ROM).

And what's the difference between this method and "officially" unlocking it via IMEI?

:)
[Galaxy S III Q&A, Help & Troubleshooting] iphdrunk:
I'm afraid I am not 100% of the exact steps I took, which indeed involved deleting old, bak and the md5 files, I used a mix of adb shell, terminal and several reboots, chmods and chown. As stated before, I did have issues with branded firmware. At some point, just rebooting the phone I got the dialog to enter the network lock code (I never touched the sim card) and dismissed it since I did not know it.

For some reason, I managed to replace nv_data.bin and it stuck. I have got several PMs to edit the nv_data files and some of them do report that the nv_data.bin does get replace again upon reboot. Maybe (just thinking out loud) changing permissions to read only? try at your own risk!). Maybe I got lucky, but went from the Network Lock "ON" to "OFF" with this, checked with the "Personalitiob" screenie. I still believe that it is quite possible that the branded firmware was the one which was causing the nv_data.bin to be recreated, but not sure.

Agreed, this is why I did not add the "use the md5 command to recreate" because I saw the codes were different and the original did not match. It is well possible that the md5 file is also encrypted.

---------- Post added at 11:49 AM ---------- Previous post was at 11:36 AM ----------

I am not sure what you mean by "proper" :) as the end result is the same. Entering the code is indeed the most straightforward one and the method one is supposed to follow, but it also requires you to do it via a (online) shop; manually, if you are able to reverse it as in older phones ; or via your operator, which may refuse to give you the code until you finish your contract, including more stringent conditions (and in some cases also for a price).

There are several ways by which the tech service can notice that one has played with the phone :) starting with seeing a rooted a phone. Since just by rooting it you are voiding it, I am not sure whether they would check for more picky things such as seeing that the encrypted hash contains a code even if the lock is off, a different access time, etc. One can check by IMEI if the phone was originally locked, etc.

Another consideration is the legal one. It depends, see

http://en.wikipedia.org/wiki/SIM_lock

No, once unlocked it stays unlocked (at least for me) although installing a new ROM may loose root.

the end result is the same, the differences are in: risk, cost, time and warranty
[Galaxy S III Q&A, Help & Troubleshooting] tlc77:
For my part, I did all the test without SIM Card (i must cut my sim card to fit to microsim format). So i never had the dialog to enter the network lock.

I just verify the lock state with *#7465625#... Maybe it explain the differents of behaviour...

What is the risk ? The "phone feature" no longer works until a backup is restored or the phone risk of crash completely ? :rolleyes:
[Galaxy S III Q&A, Help & Troubleshooting] AMladenov:
Vodafone UK

Can anyone, who has purchased one from Vodafone UK, confirm whether it is simlocked or not ?
[Galaxy S III Q&A, Help & Troubleshooting] d4fseeker:
It could also go up in flames.

Since you can also access the efs partition in CWM (you might have to manually mount it, can't check right now) there's not a high risk.

However there is a logfile, calibration data, ... on the partition, so mounting the whole mmcblk0p3 (which btw is an ext4 partition) ro could cause issues or undesired side effects.

I'd recommend taking a bit-by-bit copy of the efs partition through dd first just in case.

dd if=/dev/block/mmcblk0p3 of=/mnt/sdcard/efs.dump

You might want to try using the EXT 'immutable' file-attribute which keeps even root from modifying or deleting the file UNLESS the immutable is revoked first.

chattr +i /efs/nv_data.bin*

If you want to modify the file or just revoke the immutable attribute

chattr -i /etfs/nv_data.bin*

Usually most scripts and programs are unaware (or plain too stupid) to understand a permission denied when they run as root since (usually) root can do anything and everything.

Edit: Could someone who modified his nv_data.bin check if the phone is still so kind (as was with the SGS and afaik SGS2) that it tells in the log in /efs what the correct md5 should've been before it replaces it with it's generic version?
[Galaxy S III Q&A, Help & Troubleshooting] E:V:A:
Good info! I had almost forgotten about that stuff.

Here are more details around chattr and lsattr.

Someone should run lsattr on the efs directory and see what turns up.
[Galaxy S III Q&A, Help & Troubleshooting] Astrofrigo:
The result (unlocking the phone) is the same, but the method is not the same. For example, obtaining the code via IMEI (be it from the locking company or from an online unlocker), unlocks the phone the "official" way. The question is: does the code you enter, actually modify the files you modified? I guess that's what I mean by proper way: to know if both methods do the same modifications to the phone. Otherwise, the tech service would be able to see that the phone was unlocked via modifying files manually, instead of using the "official code" and therefore having the warranty void.

I meant my questions keeping in mind that I'd first restore the phone to its original factory state.

Is it possible to find the unlock code like it was possible on SGS2? using the SGS2 Unlock app by Helroz for example, it would give you the unlock code.

:)
[Galaxy S III Q&A, Help & Troubleshooting] d4fseeker:
Nothing special, only the A-flag (noatime) set for all files.

Let's hope Samsung also forgot about filesystem attributes =)
[Galaxy S III Q&A, Help & Troubleshooting] MasterElwood:
If you are willing to spend a little coin - they send you the code...

http://www.semaf.at/shop/produkt/5219/523/samsung-galaxy-s3-entsperren-per-code/
[Galaxy S III Q&A, Help & Troubleshooting] iphdrunk:
Based on what I have observed, in previous SGS2, yes, the result on entering the code resulted in changes is the nv_data.bin file which included, typically, the reset of the flags and the reset of the MCC/MNC found. There could be other changes, but I don't remember them. In short: buying the code and unlocking it after a sim change will modify nv_data.bin

I guess (unconfirmed) that, if you are able to root the phone, unlock it, and then flash a firmware that corresponds to a "released" phone, with a right combination of phone/modem/csc..., remove root, flash and use triangle away, etc., remove recovery, remove the root apps, etc. and remvoe all traces of your rooting the phone, it could pass for an original unlocked phone.

Yes but it is extremely hard. This is based on info found on xda, based on posts form Oida, E:V:A et al. In short, the previous versions of SGS2 stored the netowrk unlock (8 digit code) within the nv_data.bin file, hashed and with no or a trivial "salt". Also the other locks such as the unfreeze one, etc.

For example, consider the code "12345678" hashed with md5

~# htpasswd -m -n iphdrunk
New password: 12345678
Re-type new password: 12345678
iphdrunk:$apr1$kUJUNga3$Jq1lQ9c2AlJvRR8IXc5cU.

I can store this hash, which is "safer" than storing it in plaintext, and it is fast to check whether an input code "matches" or not. AFAIK the hashes in nvdata.bin are right after the bitpattern 'x01 00 00 00 etc. and are 20 bytes long, Thus, to "obtain" the code means, basically, to try the space of all 8-digit codes and see which hash matches (this is what ighashgpu does). One of the key things to understand here is that the method is able to obtain the code in seconds because the space of solutions is relatively small: passwords of size 8 where every single byte is a digit. If the salt changes or the hash is slow or the password is more complex, the amount of time it would take would be way greater.

With latest SGS2 and with SGS3 they added another "layer": the code can be hashed and then encryted. The key used to encrypt the key can be different for each phone. If I take the hash $apr1$kUJUNga3$Jq1lQ9c2AlJvRR8IXc5cU, pad it with more bytes and then use a block cypher such as AES, resulting in a 32 byte stream, also stored in the nv_data.bin I end up with a raw stream of bytes which cannot be broken easily.

You may wonder... "but the phone needs to be able to check a code". It seems that the key used to decypher is available at modem.bin. One could (I haven't done this myself, fyi) patch the modem.bin to access the key (AFAIK, Oida patched the driver so it would return the key when sending a given AT command).

the methods to "recover" the code do not seem to work
[Galaxy S III Q&A, Help & Troubleshooting] Astrofrigo:
Damn, that is indeed harder. Thanks for your answers.

So for now the way to unlock the phone is by using your method or "officially" obtaining a code via IMEI. I also guess that this is an early stage and they will find a better or easier way to do it for less experienced users. I don't really need to worry about this as my SGS3 is unlocked :D but I'm "investigating" a little for other users who are interested in unlocking theirs.

Thanks again!
[Galaxy S III Q&A, Help & Troubleshooting] Odia:
The key is not available but the routine to return the key is available and its not used to decypher, its used to encrypt the code input by the user and then both encrypted versions are compared.
[Galaxy S III Q&A, Help & Troubleshooting] tjjpowles:
Hi

Does anyone know if an SGSIII is locked on O2 UK network?

Cheers
[Galaxy S III Q&A, Help & Troubleshooting] kushti90:
o2 sim lock

Hi, I can confirm that if you got the s3 from O2 then unfortunately it is locked to their network :(
[Galaxy S III Q&A, Help & Troubleshooting] ysr84:
Any solution to unlocking???
[Galaxy S III Q&A, Help & Troubleshooting] jonny68:
Anyone know if it's simlocked on 3 Ireland?
[Galaxy S III Q&A, Help & Troubleshooting] beautyangel:
nothing yet

just wondering if something new to sim unlock our SGSIII :(
[Galaxy S III Q&A, Help & Troubleshooting] Bruno Rodrigues:
Waiting unlock

Eagerly waiting for some news about it. Donation to the first that gaves me a solution...
[Galaxy S III Q&A, Help & Troubleshooting] ccernescu:
Bruno ,

Here are the steps how to unlock your S3 (see attached):

1.Root your phone.Backup EFS folder.Note IMEI *#06#_NetworkLock_ON*#7465625#.

2.Extract_nv_data.bin_Original

3.Change_nv_data.bin_replace_and_restartS3

The nv_data.bin owner : radio and rwx rights (700)

4.Copy_MD5value_from_nv_log_afterStep3

5.Change_nv.data.bin.md5_with_value_from_Step4_copy_restartS3

6.Check_IMEI_and_Network_Lock_should_be_OFF

I'm assuming you know/have already rooted your S3.

If you need help let me know. ;)

Good luck !

Have a nice day !

Cristian Cernescu
[Galaxy S III Q&A, Help & Troubleshooting] Bruno Rodrigues:
Thanks!

Thanks ccernescu,

I will try it tomorow. I'm at work now!

I'll let you know how it worked.
[Galaxy S III Q&A, Help & Troubleshooting] armandsx:
Works Perfect Thank You !!!!
[Galaxy S III Q&A, Help & Troubleshooting] micke7:
For MD5, the solution was before our eyes! Thank you!
[Galaxy S III Q&A, Help & Troubleshooting] faddys123:
I don't get how you do it sorry? First you need to root your phone thats all i know
[Galaxy S III Q&A, Help & Troubleshooting] marmotz:
Could you write a short but explicit how to ?

My phone is rooted, but how to backup efs, extract nv_data.bin and do all others command ?
[Galaxy S III Q&A, Help & Troubleshooting] luminouche:
To backup, you make a copy of all your /efs folder to your SDCard with RootExplorer for example... (Copy/Paste)
[Galaxy S III Q&A, Help & Troubleshooting] marmotz:
I follow your steps but it's not work for me.

I must backup and restore nv_data.bin.

So here are the steps I follow:

Root your phone.

Backup /efs folder.

Change /efs/nv_data.bin rights to rwx rw- rw- (755)

Edit original nv_data.bin and replace "01" to "00" in adress 181469 and save

Backup your /efs/nv_data.bin in /sdcard

Change /efs/nv_data.bin rights to rwx --- --- (700)

Reboot your phone.

Open /efs/nv.log and search the last line with "MD5 fail" and copy the second md5 checksum

Change /efs/nv_data.bin.md5 rights to rwx rw- rw- (755)

Edit /efs/nv_data.bin.md5 and replace current checksum by the copied checkum in previous step and save.

Change /efs/nv_data.bin.md5 rights to rwx --- --- (700)

Delete /efs/nv_data.bin

Move /sdcard/nv_data.bin in /efs

Change /efs/nv_data.bin rights to rwx --- --- (700)

Reboot your phone.

Check Network Lock with *#7465625# (should be OFF)

Enjoy your new unlocked GS3 !!!!

Notes:

To backup /efs* I use ES Explorer

To edit nv_data.bin, I use HexEditor

There is a new line after checksum in nv_data.bin.md5, I think it's important, but not sure