[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Full unlocking proces revealed (PART I)

Finally I managed to capture everything the unlocker does, this should be enough for an experienced programmer to write a free unlocker, so anyone interested please read this comment (two parts) and download this file:

unlocker-reversed.zip (EDIT: file removed as IMEI-check claimed it is IMEI-check copyrights stuff. Sorry.)

The file contains this information:

activesync-files
files transfered to the unlocker via activesync to prepare the fake
bootloader environment. This is sent before the unlocker requests the
key (unl) file.

imeicheck-unlocker
Version 3c of the imei-check unlocker, used to capture the process and
extract the files found here

migsoft-signed-bootloader
NBH file signed by MIGsoft, sent to the fake bootloader to flash
IPL-1.01 and SPL-1.04.
The .dbh file contains the same NBH without the signature wrapping.
*.nb files is the extracted contents of the NBH file.

process-captured
Two different unlocking process captured, see included readme for
details.

rversion-0106/00-rrbmc-6D0000-8000.bin
content read from device
rversion-0106/00-rwdata-4D0000-800.bin
content write on device by the unlocker

rversion-0107/rdparam-files
content read from device

rversion-0107/rwdata-files
content write on device by the unlocker

Basically what they do is patching some parts of the radio to make sure the unlocking code will be always the same, at the end of the process the same AT@SIMLOCK commands are used to really unlock the phone after the radio is patched.

Now the process explained:

turn phone on and connect to pc (green ActiveSync icon in system tray)

When you see the green icon in system tray then ActiveSync is connected properly to your phone

Click on M3100v3cUnlock.exe, this message apperars on screen:

HTC Hermes v3c unlock

Starting communication.................

While this happens your device is in ActiveSync mode, and the unlocker transfers 2 CAB files, one XML file and one RGU file to the Hermes, installs the first signed cab file (deleting it after) and installs a certificate to your phone so it doesn't complain about running unsigned code when the other files are executed:

Transfer: \Windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.cab

Trasnfer: \Windows\CM_Entries.XML

run: wceload.exe ? /nouninstall /noui /delete \windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.cab

Transfer: \Windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.rgu

Transfer: \Windows\8a227ad5-481f-42a3-9e80-a76dad03e0c1.cab

run: wceload.exe ? /nouninstall /noui /delete \windows\8a227ad5-481f-42a3-9e80-a76dad03e0c1.cab

run: 8a227ad5-481f-42a3-9e80-a76dad03e0c2.rgu /register

After the rgu file is executed, the phone jumps to a "fake" 1.04 bootloader which is somewhat different from the "real" 1.04 bootloader:

It allows flashing code signed using MIGsoft certificates instead of HTC certificates.

It shows as if your device was SuperCID (info 2) and security level=0 (task 32).

It shows your IMEI inside the 'info 3' command output.

It doesn't show IPL and SPL versions on the top left side of the tri-color screen.

The unlocker shows this:

Checking device...

Your IMEI: 3577XXXXXXXXXXX

While this happens, the unlocker issues the command 'info 3' to the fake bootloader, so it sees which is your IMEI to compare it with the key file you get from imei-check when you pay the unlocker, and shows your IMEI on screen.​

The unlocker asks you to provide the valid key file (your-IMEI.unl), shows this on screen:

This program will work ONLY with the key generated for your phone (IMEI).
If you try to unlock with a key for a different IMEI or a bad key,
the UNLOCK WILL NOT WORK.

Please select a key file...
If you don't have a key file for your IMEI just visit your supplier site.

When you provide the valid key file, the unlocker follows.​

The unlocker shows this:

Checking device.....................................

While this happens, the unlocker sends these commands:

info 3

This returns a HTCS/HTCE encapsulated data block of 2140 bytes, which contains the information used to calculate the password to authenticate to bootloader.

password xxxxxxxxxxxxxxxxx

The unlocker calculates the password and sends it to the bootloader. As authentication is successful "Pass1" is returned.

NOTE: For instructions on how to calculate the dynamic password read the wiki.

set 1e 1

This sets the RUU command read/write flag to 1 (unlock).

wdatah 6065f 535cd095

This flashes the file HERMIMG_IPL1.01_SPL1.04_ONLY.nbh signed by MIGsoft, which overwrites your current bootloader with one containing IPL-1.01 and SPL-1.04.

set 1e 1

This sets the RUU command read/write flag to 1 (unlock) again.

set 14 1

This changes the action after reset to 1 which tells the device to start in bootloader mode after reset instead of starting the OS.

task 8

Resets the device
​

The device resets and goes into real 1.04 bootloader just flashed, the unlocker shows this:

Unlocking..._........._..... .............................

THE REST OF THE PROCES FOLLOWS INTO THE NEXT COMMENT, IT WAS TOO BIG TO FIT IN 1 COMMENT