yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
@Sleuth255:

Yes, this is correct, it will flash bootloader 1.04 on your device if you are on 1.06, it will cid-unlock your device and give you SuperCID and seclevel=0 so you can flash any rom (no matter which bootloader version you have), and if your device is sim-locked, it will remove the sim / network lock too.

But... if you pay the bucks, please follow my steps on comment #17 and also capture the unlocking process (steps on comment #1 and #2) and attach all the 3 captures. :D
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] totallytechie:
So if I unlocked my M3100 with v2, is there any benefit from doing it again with v3?

Would it even work?

Knowing my luck it'll stuff up my phone. It's been quite good so far.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jokinawa:
Yes if you use V3 then your CID will be SuperCID and Security Level will be 0. That means you can downgrade from a ROM with bootloader 1.06 with any other ROM. Essentially 'root' mode.

P.S. - You won't stuff it up. Have faith.

Jokinawa
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] mazta:
so are we any closer to a free solution? what stage are we at now?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] fun_key:
I just noticed that the super CID was not holding. After I reflashed my device with the htc rom I had my old CID again
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Crash Override:
I see 3 problems with the development of the unlocker and these are -

1) Product lifespan - HTC are bringing out new products rapidly, to keep up with every product must be a headache to say the least

2) Locking tech - they changed from a calculated unlock code to a tabled one, this would make developing unlockers a LOT harder

3) Product releases - look how many new HTC products are out now, each of which requires an unlocker.

All I know is that the team here including buzz will have a working unlocker as soon as possible (and I'm looking forward to it as I take delivery of my Hermes later this week heh) though if there's anything you guys need to help in the process, don't forget to ask

From the fact that IMEI-Check have an unlock solution out, we know it's possible, getting the xda-dev / buzzdev unlocker just take a little time :)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] krnnidtt:
comparison file

Dear Sir POF

I'm very happy coz you come back to this forum safely.

How about your trip?

Well, I attached comparison file which is former version

of sim-unlock program.(v2e)

One is original another is modified for free.

I hope it will be able to help something your reverse engineering.

kind regards,
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
krnnidtt: The trip was ok, had a lot of fun ;)

Regarding the two files you attached, they are exactly the same file and equal to the original file provided by imei-check, same size (1527808 bytes) and same md5 checksum:

485b7b65d2d9224824aa5219df39787a Herm_Unlock.exe

485b7b65d2d9224824aa5219df39787a M3100v2eUnlock.exe
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] krnnidtt:
sorry could not help

Dear Sir

Thanks your quick response, and sorry my posted file

is same both.

I could help you nothing.

If I can get or find further info will post here again.

BR,
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] D'evil69:
???

So, should I understand that now there is a free unlocker for Hermes?

Thank you.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
@D'evil69: Not yet...!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] D'evil69:
Ok. Then, keep up the good work! I'm sure you'll find a solution very soon.

Thank you, guys!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Finally I payed for the unlocker and bought myself a license of USB Monitor because my trial had expired, so I have new findings ;)

BootLoader 1.06 doesn't have 'rtask' command, the unlocker needs to downgrade to 1.04 in order to issue the at@simlock commands in radio bootloader.

The CID is "patched" before actually the .unl file with the imei is checked.

The process is like this:

When you start M3100v3cUnlock.exe the unlocker communicates to the device and does something weird I still don't understand. Then puts the device in bootloader mode and asks you for the .unl file. If you cancel the unlocker at this point and enter into bootloader using mtty.exe without disconnecting the device, 'info 2' shows SuperCID. You get your normal CID back again when you reset the device. Info 3 also returns SuperCID + your IMEI after this... very weird.

After that you open the .unl file matching your imei, and the unlocker starts flashing the bootloader (IPL 1.01 + SPL 1.04) using this command: 'wdatah 6065f 535cd095', they have created an apparently valid NBH upgrade file for that, with the following information:

devname: HERM100

cid: *

version: 9.99.999.9

language: XXX

Will post it later, cos still have to extract it completely from the capture file and make sure it is flasheable.

More to come... ;)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jokinawa:
Great news! Thanks for keeping us updated.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Here is the extracted NBH file from the imei-check unlocker, as I said it only contains a signed (wrapped) NBH file with unmodified IPL 1.01 and SPL 1.04, but may be useful for some softbank X01HT owners stuck on bootloader 1.06.

ftp://xda:xda@ftp.xda-developers.com/Hermes/Technical/RUU_Extracted_HERMES_Bootloader_1.04_only.zip

Instructions for "downgrading" from bootloader 1.06 to bootloader 1.04 'the hard way':

1) Download M3100v3cUnlock.exe from imei-check.co.uk, but do not pay ;-)

2) Turn phone on and connect to pc (green ActiveSync icon in system tray)

3) Start M3100v3Unlock.exe and close it when it asks for the .unl file with your imei, the device should stay in bootloader (tri-color) screen or a white screen.

4) disable USB connections on activesync

5) Run the extracted 1.04 bootloader-only upgrade, it will complain on activesync not connected, but allows you follow with the upgrade process while in bootloader mode.

6) When upgrade ends device will softreset and you'll have the nice bootloader 1.04 which will allow you to flash any rom without CID checking :)

will continue with the rest of the unlocking process later today, now i have to go to work :P
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
The process is a bit more clear now, will try to explain.

First the imei-check unlocker transfers a CAB file to the device via ActiveSync which installs an application named "- -", which contains at least MIGsoft LTD security certificate (used to sign the NBH file with the bootloader upgrade) and runs some other stuff like this (not completed):

wceload.exe /nouninstall /noui /delete \windows\8a227ad5-481f-42a3-9e80-a76da.d03e0c2.cab
\Windows\Customize_CSP.xml \Temp\BB_Log.txt

A file named 8a227ad5-481f-42a3-9e80-a76dad03e0c2.rgu remains on \Windows dir on your pocket pc after this, this is a binary file containing registry settings (82k).

Some code is run on wince (still have to investigate) and then bootloader is invoked with some temporary modifications which make it SuperCID and show the IMEI on 'info 3'. Will extract all this from the captures and post the files later.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] vijay_kumar:
So pof We expect a free unlocker Shortly by u ;) Really Appreciate your work u ROCKS :D
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
This is my first experience with a phone unlocker and I'm just doing this to learn, none of my two hermes is locked... but reversing the unlocker shows interesting things and ideas we could use for other things... using the same trick imei-check does to flash their signed bootloader we could do ROM cooking on the Hermes and flash our self signed code into the device (think of an AKU 3.2 like on the BA running on the Hermes!), for example.

I've never programmed under windows platform (I'm a Linux guy) and the unlocker itself is not really that important to me, but I will give as much directions as I can if anyone is interested on writing it.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
Great work pof!!! :D Interesting stuff here...

Am I correct in thinking that you could also:

a. Run M3100v3cUnlock.exe then cancel out when it asks for the .unl file

then.....

b. Just proceed directly to load any Hermes ROM I want b/c the Hermes is in bootloader mode with the temp SuperCID activated?

Why downgrade to v1.04 first since I'm already SuperCID?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Haven't tried it but I guess it will not work, because this bootloader is not the "real" bootloader but something modified which will allow flashing code signed by imei-check (MIGsoft) instead of code signed by HTC (all shipped rom upgrades).

You're not, once you exit this "fake" bootloader you have your normal CID again.

This "fake" SuperCID initial bootloader is just used to be able to flash the NBH file containing IPL 1.01 + SPL 1.04 signed by imei-check, they do this to downgrade devices with 1.06 and have the ability to use rtask command again (needed for the real unlocking process wich comes later).

Hope it is clear :)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
Ahhh... got it now. Tks!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] da4walker:
Hey pof,

great work so far. Everyone can programm things,but reverse engeneering a software and remaking the algorithm is just for real masters :)

So would it help if I buy also an license on the imei site and do some dumps so u have more to compare? (haven't done a dump until now, but it won't be so hard.)

Another question is, what happens when u flash to another rom while u are in this faked boot loader? Do u still have simlock in the other flashed roms?

thnx for your work man! Just go on!!

cu
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
If you want to do it go on, I have captured almost the full process, but still are some things I don't understand, will post here all I get when I have finished, so everyone can look at it and we can understand more things together. Most of the process can be captured event without buying it: all the activesync part and SuperCID bootloader is done before it asks you for the file, what comes after is what slimsaturn already captured. I would suggest not to buy unless you really need to unlock your unit fast or want to get more involved in the reversing process.

I think you can't flash another rom (still haven't tried it though) because the cert on the fake bootloader belongs to imei-check an the NBH from shipped roms have signatrue wrappers form HTC, so you'll get an invalid cert error from the bootloader.

Yes, the sim unlocking part is done at the very last part of the whole process (the at@simlock? commands I posted before). Still have to figure out how it is calculated, haven't reached that yet.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
When you launch M3100v3cUnlock.exe with green ActiveSync icon in system tray, it sends some files to the device using activesync. I captured the process over USB and extracted the files (see attachment).

This is what is done over ActiveSync:

1) Transfer: \Windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.cab

2) Trasnfer: \Windows\CM_Entries.XML

3) run: wceload.exe ? /nouninstall /noui /delete \windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.cab

4) Transfer: \Windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.rgu

5) Transfer: \Windows\8a227ad5-481f-42a3-9e80-a76dad03e0c1.cab

6) run: wceload.exe ? /nouninstall /noui /delete \windows\8a227ad5-481f-42a3-9e80-a76dad03e0c1.cab

7) run: 8a227ad5-481f-42a3-9e80-a76dad03e0c2.rgu /register

There is probably something else after this, I still have to investigate.

Then the "fake" 1.04 bootloader with SuperCID starts. I guess they jump from WinCE to the memory address of this fake bootloader, similar to what gnuharet does when boting a linux kernel from WinCE.

BTW, I used the "fake" bootloader from imei-check to upgrade a preproduction hermes with IPL-0.16 SPL-0.94 to bootloader 1.04 and worked flawlessly :D

Someone willing to investigate this files? I will follow with the process and let you know if find anything else interesting.

EDIT: "imei-check-activesync-files.zip" file removed as IMEI-check claimed it is IMEI-check copyrights stuff. Sorry.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] hdubli:
SUperb..Unbelievable stuff..
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Unlocker ready

This thread is no more sticky, I have published the patched radio and instructions to unlock the phone for free on another thread which is now sticky.

Please only comment on this thread if you have questions related to the unlocking process I explained or the method used to develop the free unlocker.

For downloading the free unlocker go here: Free HTC Hermes SIM Unlocker Available, and post the free unlocker related questions there.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] rsolomon:
Very interesting!

So there look to be 3 different areas which are patched, one might presume them to be (in no particular order): SuperCID, Security Level, and Ulock code.

I'm still waiting on a Cingular 8525, so I have no Hermes to play with. :(

It would be interesting to make each of these patches in turn and see which one does what. I'd take a SWAG and say the larger patch does the unlock code itself, but that's a total guess of course. Knowing what each patched area does will help us to develop a more pure unlocker and maybe sticky SuperCID and stick Security level....

Great work pof!!!!

Richard
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Arisme:
Wow someone had a busy night :)

The first part looks pretty useful in a completely unrelated way

1) Transfer: \Windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.cab

2) Trasnfer: \Windows\CM_Entries.XML

3) run: wceload.exe ? /nouninstall /noui /delete \windows\8a227ad5-481f-42a3-9e80-a76dad03e0c2.cab

with this signed program we'll probably be able to application unlock any locked device, which is a problem with newer AKUs today.

The bootloader booting trick from CE seems very interesting as well to develop and test custom bootloaders with minimal risks.

Hopefully these informations will now be used to design custom tools and a nicer unlocker that does not patch the radio ROM :)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
If i'm not wrong, SuperCID and Seclevel=0 should be the same part in the patch.

I will make the 3 patched roms with a separate patch on each one in order to understand what each part does. I have started to play a bit with IDA pro, but seems quite difficult now, and I have not so much time next week: university + work :-(

For sure ;)

Yes they seem very interesting because the first cab is signed and then it transfers a XML file conaining a custom certificate which is installed and the second cab is signed with this certificate so it does not ask the user to accept the certificate when it is run. This can also be useful for application-unlock in the ExtROM to make cooked ExtROM as in WM2003 :)

I think it is similar to what gnuharet does with the linux kernel, they have the fake bootloader in memory and jump to that address. This is done by the rgu file which seems to be a PE executable and does something with the registry also... very weird...

Yes, this has been a good starting point, but there's still a mountain to climb!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] rsolomon:
Yeah, in thinking about it some more it seems to me that the radio ROM must go read something from the device to get/calculate the "right" code. So maybe one patch piece is the SuperCID/Seclevel and another is bypassing the device read, while a 3rd fills in the read data area with canned values corresponding to the known unlock code.

I dunno, I probably need to break out an ARM disassembler and stop guessing :)

No worries, you've done an awesome job so far!

It seems like the IMEI-check folks took a locked device, acquired the correct unlock code (from the carrier?) and then reversed out how to make any device think that's the right code. If we can better understand the radio ROM/Simunlock interaction then we should be able to do a cleaner/better "fix" ourselves!

Thanks again for all your work!

Richard
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] DanITman:
So I just finished reading everything in this thread and I can't believe the amount of work you guys went through. A big Thank You.

So to get this straight the key file that IMEI-CHECK provides does not actually contain any data for unlocking the phone. All the file does is stop you from using the unlocker on another device? So in "theory" if you could get the unlocker to always say the key file is correct it will then continue to unlock your phone?

Thanks
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Yes, it just checks that the imei you provide matches the imei on the phone.

In theory yes, but in practice it was easier to sniff the process over USB with a valid key file. The binary is packed with themida and this makes it very difficult to modify or crack it.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pfmboidi:
Is the unlocking procedure reversable or is it one way?

thank you!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] URPREY:
AFAIK it's not reversible.

Why would you want to re-lock your phone anyway?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pfmboidi:
for the warranty...Isn't it true that once unlocked I would loose the warranty?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] sn00x:
think so..
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Kablo:
Hi, i've just used the Hermes procedure to (try to) unlock HTC BREEZE/Mteor. I stop at step 8 because HERM_UNLOCK_V2A.exe return "this tool cannot be used on this device".

So, i can't sim-unlock my device?

I've also tried (in MTTY)

rtask b ...

to enter in "radio Image AT-Command interpeter" and ...

but "rtask b" don't work (don't enter).

Now i've an HTC BREEZE with

SPL 2.05

Radio version 1.16.00.00 (patched for Hermes, SuperCID e security level 0)

How can sim-unlock it?

Please help me.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Kablo:
... how many trying I have at question "sim code unlock"?

Thanks
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
@Kablo: Check this thread for the Breeze:

http://xdaforums.com/showthread.php?t=282223
[Galaxy Note 3 Q&A, Help & Troubleshooting] GodCanWait:
Hi...I've Enabled The Delivery Report In SMS But Every Time I Send A Message It Bothers Me That The Ringing And vibration.

How To Disable Delivery Vibration Or Ringing Without Any Software (Like Go Sms Pro) In Android 4.4.2 ?
[Galaxy Note 3 Q&A, Help & Troubleshooting] soumen.sam:
Delivery Report in SMS only shows in notification bar, if you don’t want delivery report then why enabled it? Just disabled it from SMS settings, it will not appear anymore. If Delivery report disabled no issues with sms delivery. It reaches to user instantly.
[Galaxy Note 3 Q&A, Help & Troubleshooting] GodCanWait:
I Don't Know English Language Very Well. Maybe I Was Not Able To Express What I Mean.I Enable It Because I needed But Every Time I Sending A Message Vibrating Or Ringing Sound Gives Me Harassment.

I'm Sorry For Language Mistakes.
[Galaxy Note 3 Q&A, Help & Troubleshooting] soumen.sam:
Not an issue, I do need this too and I also don’t like vibration notification except calls. You cant turn off the sound particularly for Delivery notification unless you root it and customize it to remove this feature.

Only if your phone is in silent mode the ring will not appear for delivery report. You can easily turn off the vibration from SMS settings.

I wont advice you to root and customize the phone. What you can do is, set a low sound tone for sms only, this will be applicable for delivery tone too. Or you can turn off the SMS ring if sms notification isn’t important for you. Try this if this help.

Blocking mode also could turn off this sound, but it will turn off every notification sounds.
[Galaxy Note 3 Q&A, Help & Troubleshooting] GodCanWait:
Thanks For Your Offers And Comments.

Live Free Or Die...
[Android Q&A, Help & Troubleshooting] Blazblue00:
A little while ago I was reading about how to install a custom bootloader using Rom toolbox. Rom toolbox comes with a list of bootloaders that others have made, I went ahead and installed it, and rebooted my Warp. As it was loading, I noticed that the loader was not the resolution of my phone, so after the phone loaded i went ahead and fixed the resolution with an option that pops up. After I modified it to my screen resolution, I previewed it to make sure it looked alright, and it looked great, full screen and all! So I then went ahead and reset my phone after just making the loader big enough for my resolution, and to my surprise, it ended up just giveing me an endless black screen... I can boot into recovery, but I don't exactly want to Factory reset and loose all my stuff. Is there any way to undo the filechange, or something without loosing all my stuff?

P.S. I don't have CWM
[HTC One X] jadrisek:
Hi, i have a issue with light senzor and auto rotate. I!ll try a lot of alternate roms, CM based, Sense based... Standard i WIPE data,cache,dalwik and format /system, but autobrightness don!t work, and autorotation too. Did anyone has this problem?
[HTC One X] HTC Venom:
Does the camera work on sense ROM ? IF NO that means you have damaged sensors, check my signature for more details
[HTC EVO 3D] FishermanCZE:
Hello,

I have my HTC EVO 3D with this ROM: http://xdaforums.com/showthread.php?t=2526391 (CyanogenMod 11 - Android 4.4.3) and I cannot connect my phone with computer and use ADB. The reason is propably that when I connect my phone to PC it is shown as Mass Storage with name "HTC" (YES, I have USB debugging on). I have tried to reinstall drivers several times but it still says that my drivers are correct. I have the latest adb (1.0.31).

Thanks for help.
[HTC EVO 3D] FishermanCZE:
BUMP?
[HTC EVO 3D] Brian706:
Hey man! My first thought was that you need to update adb but I see you've already done that. Assuming you're not having any driver issues, I want to say that the phone needs to be in charge only mode (not mass storage).

Now if that simple change doesn't help anything, and you're on the updated adb, it has to be a driver issue, cable issue or issue with some other software running on the computer.

HTC sync for example can interfere with fastboot/adb. Even if your drivers are okay.

Also, since jellybean; with the updated adb, there is an on-screen prompt as a newer security feature.

So make sure your screen is awake and check to see that you aren't getting a prompt to allow your computer to communicate with the device via adb.
[HTC EVO 3D] FishermanCZE:
My phone is in charge-only mode. In the computer my phone appears as a Mass Storage but I don't see it in "My Computer" as a device (only in Device Manager). I have tried to install HTC Sync, uninstall it and so on.. I'have also tried to connect my phone to another computer and it makes same things...
[HTC EVO 3D] FishermanCZE:
Noone knows? :(

Interesting fact is that HTC Sync also doesn't see my phone...
[HTC EVO 3D] Arthemedus:
This might be far off but have you installed bluestacks or anything similar? It's known to mess with ADB and the like.
[HTC EVO 3D] Brian706:
Also you could try a Ubuntu live cd as it should eliminate any driver issues.
[HTC EVO 3D] FishermanCZE:
Well, I haven't.

What should I do with Ubuntu?
[HTC EVO 3D] perez6991:
What version of windows are you running? 8.1? If so yo need to Disable driver security reinforcement (or whatever its called) then install drivers again.
[HTC EVO 3D] tom0769:
Look here.

This is originally not dedicated to your phone but should work as well.
[HTC EVO 3D] FishermanCZE:
This finally works! Thank you so much. I have no idea why this works because I have tried this several times. Now everything works just perfect!