[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
How to make the unlocker using a patched radio

OK, I know how to make the unlocker... it is almost ready... but as I like to share the knowledge here it is the process to patch the radio:

I took 1.13 radio from cingular's 1.31 rom, the same I used to unlock my device.

1) Extract radio 1.13 from the shipped rom:

nbh2dbh.pl HERMIMG_Cingular_1.31.502.1_SHIP.nbh HERMIMG_Cingular_1.31.502.1_SHIP.dbh

dbhdecode.pl HERMIMG_Cingular_1.31.502.1_SHIP.dbh

This generates GSM.nb which contains the shipped original 1.13 radio.

2) Join all the files I extracted from the imei-check unlocker:

cat 01-rwdata-0-10000.bin 02-rwdata-10000-10000.bin \
03-rwdata-20000-10000.bin 04-rwdata-30000-10000.bin \
05-rwdata-40000-10000.bin > imeicheck-0-50000.bin

cat 06-rwdata-100000-10000.bin \
07-rwdata-110000-10000.bin 08-rwdata-120000-10000.bin \
09-rwdata-130000-10000.bin > imeicheck-100000-140000.bin

cp 10-rwdata-158000-8000.bin imeicheck-158000-160000.bin

3) Extract the same parts from the original radio to compare them:

dd if=GSM.nb of=pof-0-50000.bin bs=1 count=327680
dd if=GSM.nb of=pof-100000-140000.bin bs=1 count=262144 skip=1048576
dd if=GSM.nb of=pof-158000-160000.bin bs=1 count=32768 skip=1409024

4) compare the parts overwriten by imei-check unlocker with the same parts on original radio:

hexdump -C -v imeicheck-0-50000.bin > imeicheck-0-50000.txt
hexdump -C -v pof-0-50000.bin > pof-0-50000.txt
hexdump -C -v imeicheck-100000-140000.bin > imeicheck-100000-140000.txt
hexdump -C -v pof-100000-140000.bin > pof-100000-140000.txt
hexdump -C -v imeicheck-158000-160000.bin > imeicheck-158000-160000.txt
hexdump -C -v pof-158000-160000.bin > pof-158000-160000.txt

diff -u pof-0-50000.txt imeicheck-0-50000.txt
--- pof-0-50000.txt 2006-11-05 04:19:31.000000000 +0100
+++ imeicheck-0-50000.txt 2006-11-05 04:19:18.000000000 +0100
@@ -3199,8 +3199,8 @@
0000c7e0 5c f3 7c d8 f7 57 7c d8 13 13 7c d8 0c 6b ab d1 |\.|..W|...|..k..|
0000c7f0 0c 16 ab d1 13 24 bf d1 c2 13 13 de a1 60 9f d1 |.....$.......`..|
0000c800 8d 13 13 13 5c 13 13 13 2f 13 13 13 13 13 13 13 |....\.../.......|
-0000c810 ce b2 ae 13 ce b2 ae 13 ce b2 ae 13 13 13 13 13 |................|
-0000c820 ce b2 ae 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
+0000c810 42 6e ae 13 42 6e ae 13 42 6e ae 13 13 13 13 13 |Bn..Bn..Bn......|
+0000c820 42 6e ae 13 13 13 13 13 13 13 13 13 13 13 13 13 |Bn..............|
0000c830 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
0000c840 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
0000c850 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
@@ -4223,8 +4223,8 @@
000107e0 5c f3 7c d8 f7 57 7c d8 13 13 7c d8 0c 6b ab d1 |\.|..W|...|..k..|
000107f0 0c 16 ab d1 13 24 bf d1 c2 13 13 de a1 60 9f d1 |.....$.......`..|
00010800 8d 13 13 13 5c 13 13 13 2f 13 13 13 13 13 13 13 |....\.../.......|
-00010810 ce b2 ae 13 ce b2 ae 13 ce b2 ae 13 13 13 13 13 |................|
-00010820 ce b2 ae 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
+00010810 42 6e ae 13 42 6e ae 13 42 6e ae 13 13 13 13 13 |Bn..Bn..Bn......|
+00010820 42 6e ae 13 13 13 13 13 13 13 13 13 13 13 13 13 |Bn..............|
00010830 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
00010840 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
00010850 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
@@ -6142,7 +6142,7 @@
00017fd0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00017fe0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00017ff0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
-00018000 d4 50 c0 e0 01 01 17 33 6c 22 52 16 16 96 63 ff |.P.....3l"R...c.|
+00018000 d4 50 c0 e0 01 01 17 33 6c 22 52 16 63 63 63 ff |.P.....3l"R.ccc.|
00018010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00018020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00018030 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|

diff -u pof-100000-140000.txt imeicheck-100000-140000.txt
--- pof-100000-140000.txt 2006-11-05 04:23:06.000000000 +0100
+++ imeicheck-100000-140000.txt 2006-11-05 04:22:54.000000000 +0100
@@ -1,5 +1,5 @@
00000000 a8 4f 70 b5 fd 38 6a 49 b9 17 50 c0 e0 01 01 17 |.Op..8jI..P.....|
-00000010 33 6c 22 52 16 22 16 f6 13 13 13 13 13 13 13 13 |3l"R."..........|
+00000010 33 6c 22 52 22 22 16 f6 13 13 13 13 13 13 13 13 |3l"R""..........|
00000020 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
00000030 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
00000040 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 13 |................|
@@ -749,7 +749,7 @@
00002ec0 1a 10 13 b5 13 13 a3 d8 c2 13 13 8e ca 24 7c 84 |.............$|.|
00002ed0 54 13 7c 84 25 ce ff dd e6 13 13 de ca 33 7c d8 |T.|.%........3|.|
00002ee0 a6 24 6a 8f 13 13 a0 d1 5a 10 13 b5 13 13 a3 d8 |.$j.....Z.......|
-00002ef0 54 13 13 8e ca 24 7c 84 54 13 7c 84 52 ff ff dd |T....$|.T.|.R...|
+00002ef0 54 13 13 8e ca 24 7c 84 54 13 7c 84 fc cf ff dd |T....$|.T.|.....|
00002f00 13 a3 7c 84 c2 13 13 de 24 24 7c d8 a4 13 6a 8f |..|.....$$|...j.|
00002f10 92 e5 ff dd c1 e5 ff dd 1b 13 7c 84 ce 90 1c fb |..........|.....|
00002f20 67 4d 21 2e 94 13 13 13 67 47 cb cb 39 13 13 13 |gM!.....gG..9...|

diff -u pof-158000-160000.txt imeicheck-158000-160000.txt
--- pof-158000-160000.txt 2006-11-05 04:26:55.000000000 +0100
+++ imeicheck-158000-160000.txt 2006-11-05 04:26:39.000000000 +0100
@@ -374,7 +374,7 @@
00001750 5c c9 fc 8f 14 51 c3 fc 68 8e 6d ff 8f 8e 8f a6 |\....Q..h.m.....|
00001760 8a c9 a3 90 68 bc e6 e6 8f ec 2c 2c 81 14 0b 0b |....h.....,,....|
00001770 96 4f b0 af 96 4f bf 5c 54 96 79 c9 4f 1e 5c 51 |.O...O.\T.y.O.\Q|
-00001780 8e 8e ff a9 5c 26 68 fc 5a da 79 ff bc 5c 1b 5c |....\&h.Z.y..\.\|
+00001780 8e 8e ff a9 5c 26 68 fc 5a da 14 ff bc 5c 1b 5c |....\&h.Z....\.\|
00001790 d7 34 4a 0e 0e c9 14 0e 4a 51 1b 4f fc 0e 05 be |.4J.....JQ.O....|
000017a0 96 32 8f bf 0b 51 16 8f 79 50 96 ee a9 8e 68 68 |.2...Q..yP....hh|
000017b0 c2 26 79 8f 68 0d 5c a8 e5 55 c9 4f 6d 96 5c ec |.&y.h.\..U.Om.\.|

5) Generate a patched radio with imei-check's modifications:

I will take some parts from the original 1.13 radio (GSM.nb) and some other parts from the imei-check patches, the layout should be like this:

RADIO FROM - TO (hexa) | FROM - TO(bytes)| Where to take
------------------------+---------------------+----------------------------
0x00000000 - 0x00050000 | 00000000 - 00327680 | imeicheck-0-50000.bin (327680 bytes)
0x00050000 - 0x00100000 | 00327680 - 01048576 | GSM.nb (720896 bytes)
0x00100000 - 0x00140000 | 01048576 - 01310720 | imeicheck-100000-140000.bin (262144 bytes)
0x00140000 - 0x00158000 | 01310720 - 01409024 | GSM.nb (98304 bytes)
0x00158000 - 0x00160000 | 01409024 - 01441792 | imeicheck-158000-166000.bin (32768 bytes)
0x00160000 - 0x00D80000 | 01441792 - 14155776 | GSM.nb (12713984 bytes)

The commands used to generate the patched radio:

dd if=GSM.nb of=patched-50000-100000.bin bs=1 count=720896 skip=327680
dd if=GSM.nb of=patched-140000-158000.bin bs=1 count=98304 skip=1310720
dd if=GSM.nb of=patched-160000-D80000.bin bs=1 count=12713984 skip=1441792

cat imeicheck-0-50000.bin \
patched-50000-100000.bin imeicheck-100000-140000.bin \
patched-140000-158000.bin imeicheck-158000-160000.bin \
patched-160000-D80000.bin > gsm113-patched.nb

6) Now I compare the patched radio with the original one, to make sure all the process was correct:

hexdump -C -v gsm113-patched.nb > gsm113-patched.txt
hexdump -C -v GSM.nb > GSM.txt
diff -u gsm113-patched.txt GSM.txt

7) Done, what does this means?

If you flash this patched radio then your device will be SuperCID and Security Level=0 and can be unlocked using this unlocking code: 22051978

After flashing another radio ROM (or shipped ROM) your device will be CID-locked again and Security Level=FF (unprivileged) but it will remain sim-unlocked forever.

So there's really no need to program an unlocker... I will make the nbf and provide the radio upgrade, so anyone can unlock their hermes for free :) :)

Expect the free unlocker in another thread in a while.... ;)