yashsingh1/xdaforums huggingface dataset:
[Moto X Q&A] yefonme:
hey buddy,I got a problem with this：when I dial ##DIAG# on my phone,and nothing happened...In addition, I also tried *#*#4636#*#* the same with that.I think I should try another ROM.
[Moto X Q&A] samwathegreat:
Thanks for you dedication to this. I suggest that we wait for [MENTION=2026715]ezeuba[/MENTION] to provide us with more detailed and exact instructions. He is very experienced with using the CDMA tools that are necessary to read the NVITEMS and/or EFS using tools such as DFS, and CDMA Workshop.

Better safe than sorry....

He has advised that his XT1056 will be delivered by Wednesday at the latest, so we may have to wait a couple more days before we proceed with trying to crack this, but I'm hopeful that the wait will be worth it....

After he has received his device, he will give us the exact methods to get what we need (hopefully). :good:

EDIT: is your phone on the 4.4.2 stock Sprint ROM?
[Moto X Q&A] ezeuba:
There are 2 ways to get to DIAG mode on this device. If ##3424# doesn't work, you can try the default for most Motorola devices: Power off phone. Hold down BOTH Volume Buttons and press the Power Button (It's called the 3-finger salute). When the phone boots, it will display a diagnostic screen in BLACK & WHITE called Fastboot Mode with options to scroll to and select. Use the Volume Down Button to scroll and the Volume Up Button to select. Scroll to the bottom of that list and when BP TOOLS is highlighted, press the Volume Up Button. The phone will restart and if you have Motorola device drivers on your computer, it will install the correct port (something like BP DIAG port - look for it in your computer's Device Manager to get the port number). Unrar and run the NV reader/writer I posted earlier, select the correct port number you saw in Device Manager, click Connect, then click Read and it will display the phone information. You are OK at this stage, the software can read the phone. Go to "NV-items" section and click READ. NEVER CLICK WRITE. We are not writing anything to the phone's NV for now. Hang back and wait for it to finish. When finished, it will output a text file with the NV items that were read from the phone. You will name the file and select a location to save it. This, I hope, is what we require. Please anyone is free to point out any inconsistencies in this short tutorial so that we can achieve our aim.
[Moto X Q&A] yefonme:
You're welcome,looks like things are getting better,here is my nvram file:

h**p://pan.baidu.com/s/1jGur7qm

I use a verizon firmware before ,because it has Chinese,haha:laugh:.But i don't know why ##DIAG# not work.

So I flashed it to Sprint 4.4.2 to got this.

Keep it up，we can do it!:p
[Moto X Q&A] hsngt:
That's the spirit

And here is my file

https://drive.google.com/file/d/0BwAVXJqBduIKQTNhVHdac1JKdU0/edit?usp=sharing
[Moto X Q&A] jaaa1976:
NV-items moto x sprint.txt

NV-items moto x sprint.txt ..Im read with NV-items_reader_writer :good:
[Moto X Q&A] samwathegreat:
Wow! You guys are QUICK! I will analyze these ASAP.

[MENTION=5918189]hsngt[/MENTION]: access requested, please approve :)

---------- Post added at 10:44 AM ---------- Previous post was at 10:38 AM ----------

Thanks [MENTION=5298002]yefonme[/MENTION]!

Unfortunately, whatever format your NVITEMS are in is not very conducive to to being able to run for comparison.

It appears that [MENTION=4493820]jaaa1976[/MENTION] used the program that was linked by [MENTION=2026715]ezeuba[/MENTION] , and this format will be MUCH easier for me to do a full comparison.

The format your file is in (yefonme) is very difficult to read, and the NVITEMS are not labeled in the same way as the file jaaa1976 has shared.

Could you please re-read the NVITEMS using the tool posted by [MENTION=2026715]ezeuba[/MENTION] instead? This will allow me to run a binary-level comparison VERY quickly, and better understand the data I'm looking at.

We are dealing with 1,607 NVITEMS here, so the file being in a read-friendly format is very important...

Thanks again for all of your generous help!!!
[Moto X Q&A] yefonme:
:eek:I'm sorry to that, dude. I extracted that with Vmware in Mac,maybe have some problem. Anyway, I extracted it again by my PC, and here it is: http://pan.baidu.com/s/1c07vdcs

I hope it'll be able to help you.;)

Sent from my MOTO X
[Moto X Q&A] Vivjen:
Sorry. Here it is https://anonfiles.com/file/305d83375acd0037a9822fc8f6b7b623.

I could send one Sprint's motherboard to you for test free of charge too
[Moto X Q&A] Vivjen:
They are different. Which FW are you using?

Here is version for ATT, TMO and Latin versions. It will not work correctly on Sprint, Verizone, RW, Europian and possibly on Asian Moto Xs

https://anonfiles.com/file/9821ee6349b731ddbd53ae69ce1c704b
[Moto X Q&A] hsngt:
I need Arabic language, and I've found it in Asian version.

So, is that gonna have Arabic?!
[Moto X Q&A] samwathegreat:
Thanks everyone. I hope we are on to something here...

I have been comparing the NVITEM dumps but there are MANY items to go through. A simple diff was not possible because many NVITEMS are inactive between the different dumps and so I'm having to [mostly] go through them manually. This is taking alot of time... I AM working on it during the free time I do have, but I still have quite a bit of analysis to do.

If anyone else knows anything about qualcomm chipsets and NVRAM items, you are welcome to assist. Here is a good reference: http://xdaforums.com/showthread.php?p=33230677

^^ Do not take this list as exclusive. Many NVITEMS have been re-purposed over the years, and a great many of them are 'reserved' - we don't know exactly what they do. Please don't read the reference and assume that every listed NVITEM is responsible for the purpose listed in the guide - use it as a reference only.

Also, as I have stated previously, do not attempt to write any NVITEMS unless you have a device you don't care about and it won't bother you if it somehow gets bricked.

I welcome any additional 'eyes' to assist with this. Our best asset here is [MENTION=5298002]yefonme[/MENTION] as this user has a 'sim-cracked' XT1056 and is willing to assist us with finding the solution.

Please be patient...we are making more progress now than anyone has thus far.

[MENTION=5533015]Vivjen[/MENTION] : thanks for your generous offer to donate a mainboard! I will let you know if I decide this can help.
[Moto X Q&A] TCPDump:
Hey Ezeuba,

Thanks for this info. I have an unlocked Moto X Dev Edition, and when I select BP Tools it simply boots normally. Do you know if the stock boot loader has them disabled?

Thanks!
[Moto X Q&A] ezeuba:
It works on virtually all MOTOROLA phones. Once you select BPTOOLS and press Vol Up, the phone will reboot. If you have installed MOTOROLA drivers on the computer you will get a diagnostic port. You can now read/write the phone.
[Moto X Q&A] mxcaltrz:
Another 'unfortunate' XT1056 buyer.

Hello there,

Another unfortunate 'locked' XT1056 (Sprint, Unlocked Bootloader) user here from Saudi Arabia; Glad to see you all working hard to find a workaround to this evil sim lock.

I'm ready to volunteer too! :cool:

I'm attaching the readings of my NVRAM. (Extracted as recommended by [MENTION=2026715]ezeuba[/MENTION]) :good:

Edit:

Apparently it is my first post so i can't post links. Do add drive .google .com before the link i posted below.

[google drive] /file/d/0B3O6V1Wy0a5keThkeDJ0Nm05bEU/edit?usp=sharing
[Moto X Q&A] bean1975:
I will help in any way I can (including money); I have hedged my bets and bought a Sprint Bad ESN Moto X to use it in Canada, after all it was less than $100, I have faith in the great XDA community. And I am also quite sure the price of these phones wiill go up once you can unlock them...
[Moto X Q&A] :
If its blacklisted....its disabled in the US and Canada, sorry to say.
[Moto X Q&A] Vekhez:
Right, so I have also just bought a Bad ESN Sprint X, and I am hoping that we can get something to work, if not I can use it as an iPod which is more than enough for what I actually need it for :P

But if anyone would like to hangout me ipt2gmc[at]gmail [d o t] com I can do whatever is needed and should be available most times of the day.

Cheers!
[Moto X Q&A] iBowToAndroid:
Could be stuck on an account, and in that case it would still work if unlocked. Depends on why the ESN is bad
[Moto X Q&A] :
You're fighting three issues tho.

One. You can't Sim unlock the Sprint..unless you've been a customer for awhile. And there's bounties out to solve that...and so far nothing.

2nd issue is blacklisted devices are black listed in all of North America. (Not sure about Mexico actually.)

The third issue, is buying a "bad" ESN device basically means its stolen....or wasn't paid for. It either case....we don't discuss stolen devices on XDA. Or IMEI tampering. So may not want to be posting about it either. ;)
[Moto X Q&A] jtquen:
XT1056

Just bought a Sprint Moto X with a Clean ESN. I hope you guys can SIM unlock it! :)
[Moto X Q&A] ezeuba:
Just got my Sprint Moto X delivered. Can we still get this done, or is it dead in the water?...
[Moto X Q&A] :
Its always being looked into.....but please....don't hold your breath. :)

Unless you're an Olympic swimmer and can do so a long time. Lol
[Moto X Q&A] Vekhez:
Oh we're definitely still interested :D
[Moto X Q&A] samwathegreat:
I think that post was in reference to me, since I've been doing most of the leg-work on this project. And all for no bounty, mind you, and very few "THANKS" for all my efforts, sadly :/

Guys, I've spent an enormous amount of time analyzing the NVITEM dumps, but haven't come across anything that looks like it may be the key.

Could someone else who is somewhat-knowledgable with CDMA tools and NVITEMS have a look at the dumps posted by various users, especially [MENTION=5298002]yefonme[/MENTION] , who has an actual china-hacked XT1056 that is SIM-Cracked?

I'm not finding the proverbial "smoking gun" so-to-speak.

We KNOW that the key lies in the MODEMST partitions (baseband cache), but I haven't found a smoking gun there either. We believe that the modemt1 and modemst2 partitions may contain the encrypted contents of NVRAM....

I have a couple more ideas that I will work on in the meantime, but I NEED another set of eyes to look over the data we have...
[Moto X Q&A] Vekhez:
It was in reference to anyone that is doing anything towards the project :good:

I can't analyse anything because I have no clue what I'd be looking at but [MENTION=2026715]ezeuba[/MENTION] seems to have alot of knowledge in that area. I posted my Hangouts address a page or so back (and I don't want to write it again because the robots that search through threads trying to find email addresses for stupid spammy newsletters :/) but my XT1056 is going to get here no time later than the 8th of August (9th for you guys, Australian here) and I should be able to do whatever is asked of me within reason. I wouldn't call myself a noob by any means, I've created and maintained ROM's for devices before (under a different username) but I wouldn't call myself a developer by any means. But if you need anything send me a Hangout (someone already has, couldn't tell you whom it is from this thread though) and I can get it to you.

Cheers for all the work :good:

Also there was a $120 bounty somewhere and I'd happily throw some money ($20) in the pot if we can get the unlock to work :D

Thanks heaps for all that has been done and will be done.. :D

Vekhez.
[Moto X Q&A] samwathegreat:
Thanks :). But I meant the post you replied to, not your post. Appreciate the kind words though. ;)
[Moto X Q&A] mxcaltrz:
Bounty!

aaand a bounty from my side too ;) let's roll!
[Moto X Q&A] samwathegreat:
OK, Round 3!

After several MORE hours slowly pouring through the THOUSANDS of NV-ITEMS in the dumps provided by various users, there is one particular NVITEM that has gotten my attention...

Remember, this is ALL based on speculation....but the trick in these comparisons is to try and find NVRAM values that:

*Match on the Sprint SIM-LOCKED devices, BUT

*Are Different on the China-Cracked Device

If a particular value differs between 2 or more SIM-LOCKED phones, AND the China Cracked XT1056, this usually suggests the value is not what we are looking for.

So this is my latest finding: NVITEM # 8378

On [MENTION=5298002]yefonme[/MENTION] 's device, the value is 01

On [MENTION=5918189]hsngt[/MENTION] & [MENTION=4493820]jaaa1976[/MENTION] 's devices, the value is 00

Could be something, could be nothing.

It is unfortunate we don't have another individual with a China-Cracked device to provide us with an NV-DUMP, or we could be much more conclusive with these results.

None-the-less, this is encouraging. If someone is interested in taking the "plunge" and attempting to write 01 to this NVITEM: We won't know if we don't try.

DISCLAIMER: We are in

UNCHARTED TERRITORY

here. It IS possible that you could brick your device, permanently blow a qfuse in the MSM Chipset, or any number of nasty things just trying to change this NVITEM. It is unlikely....but the disclaimer needs to be given regardless.

I would like someone **With a disposable device*** that they won't be too concerned if it is bricked to attempt to FIRST, READ NV-ITEM 8378, and if the value returns 00, attempt to write value 01

( [MENTION=2026715]ezeuba[/MENTION] can probably provide the best, safest instructions on HOW TO DO THIS, so wait for his reply!)

Again, probably nothing bad will happen at all, but take caution anyways.

I'm thinking that [MENTION=5533015]Vivjen[/MENTION] might be ideal for doing this, since this user has generously offered to donate a mainboard to our cause. If you have the mainboard lying around, perhaps you could connect it to one of your touchscreens and give this a shot.

***I WILL NOT BE RESPONSIBLE FOR ANYONE BRICKING THEIR DEVICE*** So if you aren't comfortable doing this, DON'T DO IT!!! Its that simple.

We only need ONE person to do it anyways, then we should know if it is the KEY (unlikely), or does nothing (probably)...

Please let us know if you experience any changes in SIM-LOCK status after changing the value.

Also, if any other users would be willing to follow [MENTION=2026715]ezeuba[/MENTION] 's instructions in THIS POST: http://xdaforums.com/showpost.php?p=54140569&postcount=221

We could use more data to help.

[MENTION=5427457]Vekhez[/MENTION] : Could you follow the instructions (in the post linked above) and upload NV-DUMP (or just PM it to me)?

Also, [MENTION=5533015]Vivjen[/MENTION] : I received your EFS Backup, but no NV-DUMP. This might help...

AND!!! If anyone has, or knows anyone else who has another China-Cracked XT1056 (besides [MENTION=5298002]yefonme[/MENTION] 's ), and could provide an NVITEM dump from it, this would help tremendously.

Fingers-Crossed.....
[Moto X Q&A] Vekhez:
Right, stupid question I know, but could you flash

http://xdaforums.com/moto-x/development/radio-msm8960probp232-55-52-00r-t2824925

on the Sprint phone? Because looking in about phone, the only thing that changes is the basedband model numbers as shown below.

Verizon Moto X with Verizon Radio from 4.4.2 (if the photo isn't working..because it wont for me.. its in the thread linked above.)

Sprint Moto X with Sprint Radio from 4.4.2

So would it be a possibility to flash, and if it was would it make any difference, and is it safe to do so?
[Moto X Q&A] :
Changing firmware will not unlock your sim. ;)

Not that easy on afraid.

---------- Post added at 08:32 PM ---------- Previous post was at 08:30 PM ----------

Great effort my friend!! ?

I hope everyone realizes how much you're busting your gonads here. ;)
[Moto X Q&A] Vekhez:
Not the firmware but the radio, but as I said, I doubt that it would do anything because I'd say that someone would have thought of that already.

I'll get an EFS backup and a NV-Dump to you as soon as I can, which will be sometime next week as my phone isn't getting here till then :/

Also, here's something interesting, my eBay seller said that it comes UNLOCKED but has a BAD ESN. I am thinking that he is saying that it's unlocked just because it technically is unlocked just not functioning. But I MAY have a CHINA HACKED one on the way. MAYBE. Probably not..but maybe..
[Moto X Q&A] :
Loving the disclaimers too!!

Too many say try this try that with no warnings to go along with it! ?
[Moto X Q&A] samwathegreat:
My friend already beat me to it, but yeah: Not a chance.

Sure you can flash it, but you'll still be locked.

Me too bro. Me too. :cool:

---------- Post added at 08:39 PM ---------- Previous post was at 08:36 PM ----------

Sure thing :)

You need to realize that there is:

1. Bootloader unlock

and

2. SIM-Unlock

Many don't know the difference, or don't realize that someone might be referring to one or the other, or don't bother to ask. Likely, it is BL-unlocked, and SIM-Locked.
[Moto X Q&A] Vekhez:
So I could flash it just for ****s and giggles and see what happens...

f*ck Sprint seems to be rather set on their radio locking...Telstra does it in Aus but you just ring them and they just unlock it for free you don't have to be with them for 90 days, or any of that bull****, you just ring them and they unlock it then you can cancel your plan the day after you register it. Infact I went into a Telstra shop and bought an SII, then canceled it straight after I bought it and they unlocked it. But apparently the US of A works rather differently..

---------- Post added at 10:14 AM ---------- Previous post was at 10:09 AM ----------

Yeah, I know all that silly stuffs. But I said to the guy I'm buying it from is it unlocked. And he said that it is SIM unlocked and cannot be bootloader unlocked..

Which stricked me as somewhat weird because Sprint phones can be bootloader unlocked.. but he said that he is certain that it is the XT1056 so yeah... I don't know. I guess that we'll just have to wait and see what's up.
[Moto X Q&A] :
I don't usually talk about or care about the thanks button..........but you guys should be spamming the thanks button on Sam..... ;)

Everyone else has given up on this, but he won't quit! :)
[Moto X Q&A] samwathegreat:
Sure.

Here, the carriers often subsidize the phones. Stupid....I'd rather pay full price and have a cheaper monthly plan....but its just the way it is here.

Since you have people getting these $300 devices for FREE, the carriers want to make sure they get their money back, so they do all they can to prevent you from either breaching your contract and keeping the device they paid for, or making sure whomever you sell it to has to get service through THEM. I'm not saying it's right, or pretty, or good, but the way it is here.

That's why -I- use a prepaid carrier, and paid full price for my device...

Yup, haven't heard of an XT1056 that couldn't be unlocked yet...unless it is stolen and moto has blacklisted it from being able to get BL unlock code from their website? Are we sure this guy even knows what he's talking about?

You're the best, KJ ! I went to THANK -you-, only to find that I've run out of thanks for the day.

Remember guys: YOU GET 8 THANKS PER DAY!!!! And as Forum Moderator Mike Channon says: "If you're using them ALL, every day, you are doing it right"!!! And for you guys who are new / don't know: There is a "THANKS" button in the bottom left corner of EVERY POST ON XDA.

Hit the Thanks button if appreciate what someone is doing, or you value the (sometimes ENORMOUS) amount of time they have worked on something for you.....It's just common courtesy. :good:

(What good advice from Mike Channon, right KJ?)
[Moto X Q&A] jaaa1976:
Nvitem # 8378

OK, Round 3!

So this is my latest finding: NVITEM # 8378

On [MENTION=5298002]yefonme[/MENTION] 's device, the value is 01

On [MENTION=5918189]hsngt[/MENTION] & [MENTION=4493820]jaaa1976[/MENTION] 's devices, the value is 00

Ok..do i need to change all zeros in 08378 (0x20BA) to 01 ?

look picture
[Moto X Q&A] samwathegreat:
NOOOO Only the first set (see MY picture). I'd really prefer you wait for someone like [MENTION=5533015]Vivjen[/MENTION] to try this... If you brick, I don't want to hear about it :p Plenty of warnings...

The screenshot is from [MENTION=5298002]yefonme[/MENTION]'s NVDUMP
[Moto X Q&A] :
Tapatalk. Unlimited thanks! Lol
[Moto X Q&A] jaaa1976:
moto x sprint unlocked

[MENTION=2509024]samwathegreat[/MENTION] ....All done my friend ..phone unlocked !!!!!!!
[Moto X Q&A] samwathegreat:
HAHAHAHHAHAHAHA :D :D :D :highfive: :highfive: :highfive:

Who's the MAN?!?!?!

You can send your bounties/donations to: samwathegreat@gmail.com

P.S. I will be starting a NEW THREAD, SOON with the FULL SOLUTION

And how about some more "THANKS"?!?!?!?!?

[MENTION=5533015]Vivjen[/MENTION] [MENTION=5427457]Vekhez[/MENTION] [MENTION=5298002]yefonme[/MENTION] [MENTION=5360280]jtquen[/MENTION] [MENTION=5954520]mxcaltrz[/MENTION] [MENTION=5918189]hsngt[/MENTION] [MENTION=4225534]bean1975[/MENTION] [MENTION=2026715]ezeuba[/MENTION] and everybody else that gave up on this LONG AGO, heck, [MENTION=3330181]ysabxe[/MENTION]

It's DONE :D

SPECIAL THANKS TO [MENTION=5298002]yefonme[/MENTION] --- Without you, this would not have been possible.
[Moto X Q&A] :
Wow! Great job my friend!! ;)

Now....go....unlock their bootloader. Lol

?
[Moto X Q&A] samwathegreat:
Hahaha. I'm not even going to consider touching that one. Talk about an impossible job. I'm just so incredibly stoked that I managed to crack the sim- lock on the XT1056 :D

People have been trying to find the solution for nearly a year. It's done now..... :p

Now to see if people follow through with the bounty pledges. Nothing so far.... We will see.

When I create the new thread with the full solution, I'm going to request that this thread be closed so any questions can be contained to the new thread only. Will the mods do this for me since I solved it?

I don't want it closed yet because I want to link the new thread first... But will they?
[Moto X Q&A] bean1975:
Hrm? The Sprint Moto X is listed https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/87215 here.
[Moto X Q&A] samwathegreat:
He was joking about cracking the bootloader on at&t and Verizon phones. ;)
[Moto X Q&A] bean1975:
Oh of course and the Droid 4 too while at it. I can give you a Droid 4 if you feel bored :)
[Moto X Q&A] :
I'm not sure if they'll close them. But I would think since they are redundant they might. Let me know and I'll ask a friend. ;)
[Moto X Q&A] chrisp6825:
Sam, I just realized how bad ass you are. I'd buy you a cake and offer a night of pleasure if I was on a sprint x.

Nice going man. Keep up on the learning and good work dude. We're lucky to have a guy like you in the community.

(Wanted to throw this in before the thread was locked ;)

tapa'd on my moto x
[Moto X Q&A] Vekhez:
HOLY ****. You are amazing. You seriously are one amazing human being. Can't wait for the new thread with all the info.
[Moto X Q&A] iBowToAndroid:
This is ridiculously effing awesome. I've been quietly following this thread for a long time and I can't believe it's really as easy as the Razr M/Razr HD unlock for Verizon. Wonder what other Moto devices we may be able to unlock this way...? NV 8322 was the location for that one...

I for one will be sending a donation!

And please do post a link to the new thread once it's up
[Moto X Q&A] ejlmd:
I know how hard you worked to make the SIM unlock happen for all of us using Sprint and RW Moto X. Congratulations, and thank you! I look forward to continuing to enjoy my XT1049 on my T-Mobile family plan.

Donation sent (much deserved!) :)
[Moto X Q&A] samwathegreat:
Thank YOU. I appreciate the donation - I did spend an enormous amount of time on this.

Is your XT1049 the Republic Wireless variant? If so, this probably won't work unless you are able to unlock the bootloader (Middleman is only option) and flash the entire XT1056 Sprint ROM. This is because the Republic Wireless app will attempt to make your calls through their proprietary hybrid-WiFi system. Fortunately, the middleman seems to be able to unlock ALL RW phones (haven't see a single RW user not get their code yet)...but it does cost $45...

I would love to be proved wrong on this one....hopefully you have already unlocked your BL though.

I'm working on the NEW THREAD as we speak.