yashsingh1/xdaforums huggingface dataset:
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Happygoat and no1,

i am pretty sure they write to the radio ROM some data they inflate from their "unlocking" executable file. How do I know this? Well, when I put a different SIM into my XDA IIs, after I enter the pin code, the simlock application comes up (simlock.exe under \windows\) which checks for the correct unlocking code. Now usually, you have 3 attempts available to do this, before the phone locks and says "contact customer services" or whatever. After I run their application, the counter had a value of -2billion or something, making it impossible to lock it. Interestingly enough, the memory adresses to which they WRITE, are between 0 and 10000. Is it a coincidence the simlock.exe application is 10.5kB? I don't think so!! i think they write their own simlock application to reset the counter, and then they read from 3FC000 the first 4000 bytes, and from FFFEF000 the first 20 bytes. The simlock code MUST be here!! i will post the log from the USB port sniffing tomorrow, as I don't have these files right now. It's pretty obvious to see how the bootloader works. Anyone with past experience especially with CE based devices will be able to figure out how to read these last two chunks of the radio rom.

Here's a link with some interesting files, RED has posted in the past:

http://www.pgwest.com/phone-files/

Username: xda

Passwrod: blueangel

I do agree with no1 regarding the simlock, I think this is exactly the way it works.

no1, I don't know how to do any backup to the SD card, but if you really know what you are doing in the bootloader, try reading from the memory addresses I mentioned earlier.

Keep it up guys, i think we know what their software does, we now need to find out how to read properly the output log.

Regards,

Zouga
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
Hi zouganelis and no1,

Thanks for the explanations and comments...all makes sense to me now, excellent.

Zouganelis, thanks for the website...that is the stuff I was looking for, cheers! :)

I do indeed think we are close...will report back later.
[MDA II, XDA II, 2060 ROM Development] no1:
So... if they need the .uif file AND the IMEI number, could it just be a case of using the IMEI code to decrypt the contents of the .uif file? In other words the IMEI code is the decryption key??? But what kind of encryption are they using?

I think they used simple XORing in the past for encrypting the radio, OS, and extended ROMs, but this changed slightly for the Blueangel. I wonder if they used a similar method?

-no1
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
Interesting thought...and a simple one...which explains they can turn around a request so quickly...

You might be correct...the IMEI could bear the encrypted code for simlock or not. Nowadays, encryption standards are:

DES

MD5

SHA

DES is relatively easy to "crack", SHA being the hardest...they are one-way encryptions, which mean they can not be reversed. The only way to get a match is to try...I have numerous proggies for this and will explore this option...
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
OK, did some more googling, found the following. There appear to be only 3 companies or people who can do this, which makes it even more interesting...

1. www.imei-check.com (UK)

- Download proggie

- Send them back the output and EMEI number

- Receive unlock code

2. Ebay guy (Canada): http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=43312&item=5763970199&rd=1&ssPageName=WDVW

- Sends you software

- You will run this software and it will generate a log file (data cable required).

- You'll need to email us this log file and we will send you the unlock code with instructions as soon as possible

Looks like same procedure as EMEI-CHECK

3. www.UnLockItNow.com (Company in Malta): http://www.unlockitnow.com/remote/unlock/by_cable/Pocket_PC/unlock/XDA_IIs_unlock.php

Not sure what process they use, but looks the same.

-----------------------------------------

Then I also came across this interesting story: http://www.modaco.com/index.php?showtopic=200968

This guy writes (edited):

The interesting part here is that he only had to give his EMEI number, nothing else...and received an unlock code.
[MDA II, XDA II, 2060 ROM Development] no1:
If you take the official route of unlocking your phone through your network provider, all they need is your IMEI number because they can calculate your unlock code from that.

I'm not 100% certain how the process works, but I'm fairly sure the algorithm they use to generate the unlock code is different for each handset manufacturer. I think the network provider either has to send your IMEI to the handset manufacturer for them to calculate the unlock code, or possibly the provider is given a database of unlock codes for all the handsets they purchase. This might explain why it sometimes takes them a few days or weeks to get back to you with the unlock code.

So figuring out how they convert the IMEI number to the unlock code would be another way to attack the problem. Although, I think it would probably be very difficult to figure out what hashing algorithm they're using to generate the code. But if it can be done, then it would certainly make things a hell of a lot easier!

-no1
[MDA II, XDA II, 2060 ROM Development] zouganelis:
SH*TE I have been writing a post for about half an hour now explaining the files and as soon as I logged in it was lost. :evil: :evil: :evil: :evil: :evil:

Anyways, here we go again. I am posting the files I promised yesterday. The are three JPEGs which are handwritten notes from the first time I run their application, and a log file from the second time I run the application. Here's the thing: the first time, the software send a read command for the addresses 0-10000 of the radio rom (rrbmc x 0 10000) and store in the x variable. Then it probably compared the checksum with their data, and it didn't match, so they deleted this part of the rom (rerase 0 10000) and they written their own version of it stored in a vector called data (rw data 0 10000). So far so good.

The second time I run the software, it sent again the rrbmc command but this time it didn't erase or written anything, so I guess it does actually what I said before with the checksum.

Another important remark:

The first time I run the software, the software requested some information from the device (rinfo) and the xda replied:

BlueAngel B120 C6B23C704A59520150993080051FF87B

After it finished writing, it sent the same command once more and this time the xda replied:

BlueAngel B120 C6 BE3A709999541E509810802FD775B0

Now the second time I run the application, the rinfo command returned:

BlueAngel B120 C6BC3C70B329B2B1509980809FE49B11

Can these be some form of HEX encryption keys or something?

Happygoat maybe you could use them in your nice proggies?

Anyhow, I think this is all for now. The commands in the logs should be straight forward to understand, it's just the data part which needs real decoding of some sort.

Hope it helps, regards Zouga
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
Zouga,

Thanks alot for the info...and your patience! :)

I downloaded a program called USB Monitor, which supposedly logs all data transferred via the USB port...is that the proggie you used as well?

What I want to do is run the IMEI-CHECK program on my device a few times in a row..since it was never SIMLOCKED, I wonder what the output will be...and if they will be different.

I suggest other people run this software as well with a USB port logger, so we can compare logs, and perhaps figure out precisely what we need to do.

Regarding the encryption, I will have a look. I do not think that the data you gave me (C6BC3C70B329B2B1509980809FE49B11) is encrypted...looks like plain ol' HEX to me...will do some more research.

What I think would be the ultimate solution, is to develop an app that calculates the unlock code based upon IMEI number...easy to use, no workarounds, and something I understand: Encryption... ;)

Yes, I am biased...but I am reading up on ass'y code right now to get my arms around this thing...so bare with me... :)
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Hi HappyGoat,

It's good that finally you guys got interested in this! Yes it is the same piece of software I used to sniff the port, it would be interesting to see the output of your unlocked device. Could you please post it as soon as you have it? I hope we can crack this!!

Come on guys, don't just complain for the £20 charge, give us some help here!! We should all run the software and log the data to compare them, as HappyGoat suggested. Then we should all be HappyXdaUsers :D :D

Looking forward to some news,

Zouga
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
Zouga,

Can't download the zip file (bottom one) for some reason...reports that file can not be found...can you try again please?

Cheers,

HG
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Ok I don't know why that happened. Can actually others delete files from the ftp or wherever these attachments are being stored? Try again, I've uploaded it again. Anyways...I have run the software once more (thank God we can fully backup with a click!!) and here's something else I noticed. The HEX numbers the xda sends back every time the rinfo command is sent to it have some common numbers:

C6BC3C70B329B2B1509980809FE49B11

C6BE3A709999541E509810802FD775B0

C6B23C704A59520150993080051FF87B

C6B53C783F293E5150994880AFF33329

^ ^ ^ ^ ^^^ ^^

6 3 7 9 5 0 9 80

What do you think? Do you have any more numbers to compare?

I've tried some combinations (by removing one digit at a time as the unlocking code can only be 8digits) but had no luck.
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
The returned code (for example "C6BC3C70B329B2B1509980809FE49B11") is 32-bit HEX, and could be a Blowfish or MD5 hash (also HEX and 32bit)...interesting...

What is strange, is that the response code seems to change everytime. If you encrypt "BlueAngel" in MD5, for example, the hash is "F58DA80AE1312311CACEC3371BDBBDAB".

This hash will not change in MD5 or Blowfish if you re-encrypt "BlueAngel" again, and again, and again...It yield the same hash everytime....so perhaps it is not a hash key, and therefore no encryption.

I will investigate some more.

Visit http://webnet77.com/cgi-bin/helpers/crypthelp.pl for more info and try it yourself.

The numbers they have in common:

C6BC3C70B329B2B1509980809FE49B11
C6BE3A709999541E509810802FD775B0
C6B23C704A59520150993080051FF87B
C6B53C783F293E5150994880AFF33329
--------------------------------
C6B 3 7 509 80

I will try the same tonite, and post my findings here...see if we can find some denominators.

Last request, zouga, can you PM me your IMEI number?
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Yes there are more common numbers, I was only looking at the range h'30' to h'39' but that was apparently silly as A-F are still numbers aren't they? :wink:

Anyway it's nice you know about encryption cause I don't have a clue, I'm just a poor electronic engineer :?

I'll have a look tonight at that website see if I can give any ideas.

Also, check your pm for my imei.

Later,

Zouga
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
OK, I ran the IMEI-CHECK program 3 times in a row (back to back), and have zipped the results, see attached.

What you will find:

IMEI-CHECK output file (3)

USB Monitor Log Files (3)

Log files in HTML format (3)

I have not had a chance yet to study my results, and compare them to Zega's results, so this is hot of the press. (And very late...2:16 AM)

If you do not have USB Monitor, download it...it is great!

Cheers,

HappyGoat.
[MDA II, XDA II, 2060 ROM Development] Mouseman1463:
WOW! This topic has moved on somewhat since I read it through yesterday... :shock:

Going on a previous suggestion, I thought I'd help out in the small way I could. I ran the IMEI-check program (So was in bootloader mode) and though I'd check to see if they changed the simlock to be as the himalaya is... I ran the him's bootloader unlocking program, but gave up after 4 lines of dots whilst trying to read section 1 (whichever that is). also the other Him unlock program run from the PPC yeilded nothing.

Another thing interesting me - IMEI number is 15 digits long yeh? on the sticker under the battery, + on the box label I have 15 digits. Getting it from the handset adds "01" on the end. This also happens on my himalaya and my friend's himalaya. Is this a country code? all are 01, all are from UK companies? it just threw me a bit!

I'm happy to share my .uif file + IMEI number if it's needed, but I have no USB log, sorry!

Mike
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Hi Mouseman,

Thanks for your input, every little thing can make the difference! Well, you can download the USB monitor here: http://www.hhdsoftware.com/Download/usbmon.exe

Here's how it works:

1) Install USB monitor in your computer

2) Enter bootloader mode in your PDA and place it on the craddle

3) Start a New Session in the USB monitor, selecting USB Activesync (or something similar) from the list of USB devices it will show you.

4) Start Monitoring

5) Run the htcunlock program in your computer

It should now start logging. After it's done, search for a little icon on the program's task bar which tips "Export". Export to html and you're done!

Of course all the above is if it's not a big trouble to do :wink:

Regarding the IMEI number, mine has a 01 at the end as well, and it's a T-Mobile MDA III. Maybe it's the country code as you said, not sure though.

@all: Can anyone run a debugger on the xda while the simlock.exe proggy checks for the code? Maybe we can see which memory address it compares with the input value, and instead of doing all this tricky decryption, just write a few bytes to the rom and we're done! (I suppose :? )

Any updates HappyGoat?
[MDA II, XDA II, 2060 ROM Development] oscarvilaplana:
Hi zouganelis!

I tried to do what you explain, but I have two problems:

1) The USB monitor gives an installation error on windows XP. I don´t know if this problem is because of the trial version of this program. Have you tried this unlock procedure?

2) htcunlock.exe I think is the program on the web imei-check.co.uk, isn´t it?

Thanks,

Oscar.
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Hi,

I haven't experienced any problems with the USB monitor, and i *think* i've downloaded it from the same website. I would upload the installation file on the ftp but i have it at my work pc and I won't go back until 2 weeks later as I'm going abroad. Maybe HappyGoat or someone else can upload it please? What sort of error do you get? Try disabling your firewall/antivirus before installing, if you haven't already done that.

About htcunlock.exe, yes this is the software we are talking about and I have done this 3 times so far without any problems.

Keep us updated :D
[MDA II, XDA II, 2060 ROM Development] Blueangelnewb:
I have a cingular sx66. Does my iemi number help? Also, is it not smart to share my number with people? I'd like to help but I don't know anyone here really and am not sure if it's best to give smart programmers my number. :D

Thanks!
[MDA II, XDA II, 2060 ROM Development] azeemakhtar:
almost there...i think !

hi zouganelis

... first of all thank you for the help u have given to us all to unlock xda IIs.

I did exactly what yousaid in your instructions.

I am not sure what to do now.

My xda IIs screen reads : Serial SIM-UNLOCK extracting....... done v2.06

i exported the html file like u said ... wasnt sure what to do with it.. it didnt mean much to me.

another file was also produced which i have saved down on my desktop it is called : HTCPPCPEUnlockInfo. This is a UIF file. What am supposed to do with this?

Finally, how do i get my xda IIs back into normal mode i.e. out of freeloader mode. is it now unlocked and sim free? or do i need to do something with the html and UIF files first ?

Thanks.. much appreciate your help. Azeem
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Hi Azeem,

We are trying to figure out a way to unlock the XDA IIs. The htcunlock.exe file does not unlock the phone, but it creates a log file which you have to send to a company, pay them 20 pounds and receive back the unlock code. We are trying to figure out the way to do this for free, that's why we're asking for as many users as possible to run their software and see if we can figure out their method.

Now regarding the html log, there are actually two logs created by USB monitor. On the main screen, top left corner, there are two "folders" from which you can choose. I am not sure what exactly they say, but you have to click on the right hand side and then Export to html. Sorry if I forgot to mention that beforehand.

To exit from bootloader, just to a Hard Reset. You can do that by holding the Power Button and with your stylus press the Reset button next to the data connector on the bottom of your pda. Please keep these files and we'll try and get a safe place to store them for later processing.

Sorry your phone is not unlocked yet, but we're working on it :wink:

If you have any friends which are literate with encryption/software writing etc, give us a shout, maybe they can give us a hand here.

Cheers,

Zouga
[MDA II, XDA II, 2060 ROM Development] plandregan:
This guy in Greece also claims to offere unlocking for £30

http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&category=32242&item=6380221662&rd=1&ssPageName=WDVW
[MDA II, XDA II, 2060 ROM Development] Immix:
I am from US and here is my .uif file. mine has been locked by cingular. and i know for sure that it doesnt make any difference which service provider has locked the phone. Cingular unlocks it but i am on other service so cant do that. if you guys need anything else i'll send it.
[MDA II, XDA II, 2060 ROM Development] Immix:
here is the file
[MDA II, XDA II, 2060 ROM Development] Immix:
sorry about this
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
Thanks Immix for your data...I am sure this will help us ;)

Zega (and others): If you open the HTCPPCPEUnlock.exe in a hex editor, you will see that the proggie checks for a Debugger (arround line 4000): "IsDebuggerPresent". If you do a Google seqrch for this in combination with the keyzord "debug" or "ollydbg", you will find plugins for ollydbg that will alow us to still debug the program! I am in france at the moment, working on a MAC, so I can not do anything here...will be back wednesday to continue my quest... :)

If you use SoftIce as your debugger, google for "softice" and "IsDebuggerPresent"...

One other thing I saw in the HexEditor was "CRC Check Failed" (in the error messages section)...this could be interesting as well.

Greetz,

Da Goat :)
[MDA II, XDA II, 2060 ROM Development] Genuis:
Hahahaha i can see that you are in France don't you just HATE these AZERTY keyzoards? :D I always make the same mistake when i am in Belgium

By the way, some very good work and investigation , i will see if i can contribute in any way.......

And what if we extracted the rom whit one of these commands completly?

d2s [StartAddr [Len [Type [Append[SkipStartAddr SkipLen]]]]]

Here is the same file of a locked MdaCompact from T-mobile , i also can send te same fils from one that is already unlocked and one form a simlock free S100 if you want
[MDA II, XDA II, 2060 ROM Development] Arif Haq:
UnLocking XDA IIs

Hello Everybody

Please someone can help me unlocking my XDA IIs, its locked on o2

Thankyou
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Arif Haq, it is always suggested to read first what the discussion is about, and also read the posts to figure out what the status is.

Genuis and Immix, thanks for your logs!

Happygoat, I had noticed the debugger checking message in the executable but I didn't know of any ways to bypass this, so thanks to you we'll probably manage it! I am too away from home until the 18th so i won't be able to do much work guys, sorry :(

Plandregan, I have checked with this guy in Greece (I'm Greek too, and I'm in Greece right now :) ) and he said he does not unlock them himself, he just buys unlocking codes in bulk from a friend in UK. I guess he forwards the log to someone, and receives back the unlocking code, just a reseller kind of thing.

A little thing that just came through my mind:

I think we can read any parts of the radio rom from the bootloader and write them to a file (or an array). Supposing this is coming from an UNLOCKED device, what if we replace some parts of our rom (the memory addresses I have described in my previous posts) with the ones taken from the unlocked device? I think there is a chance the code is NOT IMEI dependant. What do you think?

Regards,

Zouga
[MDA II, XDA II, 2060 ROM Development] siopaoboi:
hi guys...i'm quite new here....totally of no idea on how to do this, but i'm really eager to get my xda IIs unlocked.

i found a thread about imei number.....the end could be computed i think...here's a link. i hope this helps....

http://forum.gsmhosting.com/vbb/showthread.php?t=83541
[MDA II, XDA II, 2060 ROM Development] plandregan:
I see, thought he was a bit pricy.
[MDA II, XDA II, 2060 ROM Development] oscarvilaplana:
Hi guys!

It´s impossibe for me to run usb monitor 2.37 on windows xp, I would like to send you muy log file, but I can´t! Can someone install this program on windows xp correctly without any error? I get error number 1720, and when I load the program it doesn´t detect my ports! Could you give me the exact link from where you downloaded it? Thanks.
[MDA II, XDA II, 2060 ROM Development] zouganelis:
Hi Oscar,

I am fairly sure I have downloaded from http://www.hhdsoftware.com/Download/usbmon.exe

Please check that your firewall and antivirus are not running while installing and when running the program, as they may stop it from functioning properly.

Let us know how you get on.

Cheers,

Zouga
[MDA II, XDA II, 2060 ROM Development] Arif Haq:
Hello Zouga

Thanks for you suggession, but infact i am new to this things i really don't know much about unlocking stuff :( . its for true .....that i can try to get it....yeah.if you get anyinformation let me know please, i really appriciate for it.

once again thankx

Arif
[MDA II, XDA II, 2060 ROM Development] Genuis:
:!: If got maybe some usefull information!!!

i have 3 .uif files wiht the returned unlock code from imie-check

is this usefull? :idea:
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
Excellent...thanks for sharing...! :)

Looks like you are a good customer there...used them 3 times? ;)
[MDA II, XDA II, 2060 ROM Development] mozzer1138:
HappyGoat How's the development going with the new XDA unlocker?
[MDA II, XDA II, 2060 ROM Development] bad:
I have 3 unlocked Sim here

Take and Let's study
[MDA II, XDA II, 2060 ROM Development] nchell:
Here's another set of files, in case it helps with things :-)

Nat.
[MDA II, XDA II, 2060 ROM Development] Immix:
I got my sx66 unlocked from imei-check.com

here is a zip file with the imei number and the unlock code

i posted the .uif file earlier

hope this helps
[MDA II, XDA II, 2060 ROM Development] VietNam:
I used IMEI-CHECK service at least 5 times (for unlocking XdaIIS, XdaII Mini, T-Mobile MDA3...), but unfortunately, still kept only the last T-Mobile MD3 unlock code. Here you are
[MDA II, XDA II, 2060 ROM Development] HappyGoat:
Thanks all...!

I think we have enough files now to document and compare, and try to figure this thing out...will keep you all posted! :)