yashsingh1/xdaforums huggingface dataset:
[Sharp Aquos Crystal] Camagopra:
Has anyone tried the UICC unlock method described by Tewilove in this thread? http://xdaforums.com/aquos-crystal/general/sprint-aquos-crystal-uicc-unlock-program-t2943213
[Sharp Aquos Crystal] bcountry907:
Kernel source code

I have located source files for the Aquos Crystal.

The build num is diff but looking at the file dates it all is very new.

I believe they are for the non usa phones.

Maybe enough to get us started in the right direction.

Let me know and ill post the link tommorow.
[Sharp Aquos Crystal] RealZel:
I think it could be useful for specialists. Maybe it will help to unlock and get root.

Will wait for your link.

Thanks!
[Sharp Aquos Crystal] bcountry907:
Source codes + Flashing instructions ! links

Ok here we go so lets get serious now.

I have a rooted unlocked S4 and i still love

This aquos. Lets root this baby.

Now theese pages are in chineese so use google translate

To convert to english chrome browser on the aquos asks

If you want to translate.

Link#1 (adb driver + instructions for flashing all systems)

Look down the file the jap page is diff than english. The jap page

Has flashing instructions.

Https//: comes before link but i cant post links yet so have to

Exclude it from the link.

Sh-dev.sharp.co.jp/android/modules/driver/

Note that theese source files may or may not apply to the

Aquos Crystal. (Check build numbers)

Link #2 (is specifically for aquos crystal no doubt it says so)

Check your build numbers to see if it applies to your phonr !!

Https:// (again cant post links yet)

//sh.dev.sharp.co.jp/android/modules/oss/index.php?/crystal

Im willing to invest alot of time.

Just need an expert to point me in the proper direction

TEAM:highfive:
[Sharp Aquos Crystal] mofugggz:
source must be released by law.

A quick chat with a friend/developer informed me of the gpl license that android kernel is licensed to. They must release the kernel source within 90 days. Though like samsung and other big companies they will most likely use some flags in the wrong place and the kernel will not compile properly untill someone has reviewed the code and apply fixes where needed. I will hold off on selling phone and see if this source drops soon (kernel source that is) . things are looking slightly up. Fingers crossed and a seasoned developer on standby with my device im willing to brick.
[Sharp Aquos Crystal] myspac:
Someone correct me if I'm wrong: we know this for a long time, the problem is the "fastboot" command doesn't work with 305SH and lastest driver...
[Sharp Aquos Crystal] bcountry907:
Fastboot.

You are correct. Im connecting through adb no prob but fastboot wont connect.

Anyway heres an obsorvation.

If i hold volume up + Power Key and hold.

Blue led lights up. But screen is blank. ( maybe a clue)

So if i do that when the phone is connected to the computer.

Win asked me for the driver.

When the blue led came on the phone connected to the computer.

My conclusion is i need to load a driver to access the bootloader.

The adb commands i have used have functioned.

Anyone got the rest of the drivers.
[Sharp Aquos Crystal] trippinin:
Hey I too have an aquos crystal and would love to get this thing rooted in the future. I'm not a developer but would like to help in any way.
[Sharp Aquos Crystal] JsteedXDA:
will this apply to the 306sh as well??
[Sharp Aquos Crystal] bcountry907:
306SH

Currently it isnt for 306Sh.

But i would guess the source file names and build structure

Would be very similar.

Right now i believe what is holding back rooting the 306SH is

The inability to get into fastboot mode.

If we could access the bootloader then we maybe can pull

The system files off the phone and have somewhere to start.
[Sharp Aquos Crystal] hazridi:
Hold vol up and hit power, blue light comes on.

Attach USB, a device "306SH" shows up in device manager with VID 0x04DD (sharp) and PID 0x933A.

I tried manually updating the driver to "Android Bootloader Interface" which is the fastboot driver but that didn't work.

going to try modding the inf sometime tomorrow.

the annoying part is after about 5 to 10 sec the blue light goes off and the phone enters it's usual usb connected but power is off mode, where it shows up the charging graphic on the phone screen.

Wish I had a USB analyzer at the moment, then I could look at the traffic and see if it matches common fastboot traffic.

Some android devices require a little shim driver that is vendor specific that tells the phone to load fastboot mode. Could be the issue here.

In any case, you don't *need* fastboot support for rooting but without fastboot or a recovery we won't have roms.
[Sharp Aquos Crystal] xxxrichievxxx:
1. Softbank versions will NEVER be SIM unlocked because something about Softbank and their contracts with cellphone companies about unlocking phones to use with other cellphone service providers. I believe Sprint will be the same.

2. Japanese models will have an added security lock ontop of the root lock. This second lock is called a "miyabi" lock. We have to crack miyabi and then the root lock.

I currently have a SH-04F, it's running 4.4.2 and there still isn't root for this device. I paid around $850 for my phone and I am willing to wait.

Cheesus (whom is a really really nice guy) has a toolkit called Sharp Rooting kit which in the read me states that:

"Thanks to the efforts of Mr. fi01, unlocking the memory and acquiring root permissions can be done by automatically searching for the correct memory address in unlisted devices. It is therefore possible that this rootkit may work with SHARP devices that are not included in the list below."

So maybe it works for other devices? I haven't tried it out because I have a Macbook Pro and the program is for windows only.
[Sharp Aquos Crystal] skryte:
Maybe. But the last update was months ago.
[Sharp Aquos Crystal] JsteedXDA:
do you think we can access bootloader by using "ezunlock" apk??
[Sharp Aquos Crystal] moonalikhan:
Aquos Crystal in KSA

Today i got my Aquos crystal from Sprint Pre-paid in Riyadh as i was following the post from the start the first thing i wanted to check my STC sim in it and i tried but but no luck. but guys i did little research and found that the device it self is capable of GSM check the link in chrome as it is in Japanese .

i cant post a link yet but i will share the link once i go over ten post :)
[Sharp Aquos Crystal] tewilove:
It's not aboot interface, it's factory loader interface.

---------- Post added at 11:52 AM ---------- Previous post was at 11:47 AM ----------

Anyone can utlize CVE-2014-4943? I can crash kernel, but cannot root.
[Sharp Aquos Crystal] bcountry907:
Kernel Version

It looks like my KERNEL VERSION is 3.4.0 ima look into this. BTW. My phone is a 306SH Boost version.
[Sharp Aquos Crystal] JsteedXDA:
Recently used Sharp rooting tool 7.0

I used the sharp rooting tool 7.0 on my 306sh and there are 4 options shown when the toolkit is ran. I chose to temporarily allow root access, i use "SD MAID" and chose to delete a system application. which at the time it did and then the app froze. I had to restart my phone and the root was gone, So CLOSE but no cigar.. Maybe just maybe there is a way to gain root access through the toolkit, just may need some tweaking.
[Sharp Aquos Crystal] d@vo:
Where I can find this program
[Sharp Aquos Crystal] RealZel:
Sharp Android Rooting Tools version 7.0
[Sharp Aquos Crystal] wuyiL:
Boost Wireless SH306SHBBB

I got one from Boost Wireless and its SKU is SH306SHBBB.

---------- Post added at 02:36 AM ---------- Previous post was at 02:25 AM ----------

Thanks even though we have to register an account to download the root kit.
[Sharp Aquos Crystal] onroP89:
There are 2 Version,

Japan 305SH = GSM Version, BUT locked to SOFTBANK, the JAPAN Provider. If you manage to unlock the Phone, you can use it with any GMS Provider.

US 306SH = CDMA = NOT WORKING IN EU or any GSM Network !

To understand the difference between, read this. CDMA vs. GSM: What's the Difference?

Now the interesting part, maybe the US Version has the Hardware for GSM Networks, but its just blocked by the Sharp-Software.

What do we need to use the phone in EU or any GSM Network

A Person whos able to unlock the Japan-Versoin form Softbank or to disable the possible software block of the GMS function on the US-Version.

So far there is no public why to use the Phone in any other GSM Network than Softbank.

I found this page,

★Softbank 305SH Crystal IPS HD Display 4G - Exclusive Unlocked★

for SGD $899 ~US $720 ~ 580€

SoftBank Sharp Aquos Xx 305SH UNLOCKED GSM PHONE

And i dont pay that much:) Maybe we can buy just the unlocked ROM form him.
[Sharp Aquos Crystal] myspac:
1/ "Maybe we can buy just the unlocked ROM form him. " :

=> the problem is that evenif we have this unlocked ROM, it' not possible for us to "upload" it Inside our locked phone because bootloader is not accessible.

2/ I have asked the site of your second link ("SoftBank Sharp Aquos Xx 305SH UNLOCKED GSM PHONE") but they don't sell the phone outside US....
[Sharp Aquos Crystal] vanarebane:
Has anyone tried to access the bootloader with Ezunlock apk?

Cheers!
[Sharp Aquos Crystal] Jayarama:
It is so old now...! Risky...
[Sharp Aquos Crystal] vanarebane:
Can't hurt to try. Right?

I'm thinking, that, in theory, you could flash a different ROM on that device that gives root and you can unlock the phone.

There should be a way to hardware flash the ROM on that device, right?

Or I'm thinking about really unacheavable things here? :)
[Sharp Aquos Crystal] skryte:
You could always try and let us know.
[Sharp Aquos Crystal] vanarebane:
I don't have the phone. I wish to find out if it can be unlocked first.
[Sharp Aquos Crystal] UltimaXtreme:
Unlocked for what? GSM is still not confirmed to actually exist on the 306SH. The only confirmed way to get GSM is to have the SoftBank exlusive 305SH, and that requires being a SoftBank user in Japan. Frankly, I wouldn't hold out. If you want it and you can live with Sprint, get it. If you want GSM, don't waste the time.

In the less-than-24 hours I've had this phone, it's done everything for me under the sun, and bar a few awkward issues (Connections Optimizer seems to prioritize 3G over LTE, I have to actually CALIBRATE the touch screen, which seemed a bit unheard of for a capacitive touchscreen in 2014, and nevermind the top sensors always reading just a bit ABOVE my finger, prompting me to aim those above the circles), I've never been more in love or impressed by a phone just for the elegance and performance of the device. Even with a half charge from Sharp, the thing lasted 4 or 5 hours of SOT without plugging in. I easily activated with Ting, and had 3G and 4GLTE out of the box.

Only real complaint is the lack of expandable app storage. Installing Magic 2014 along with all my standard apps has already put the device down to less than 1/8 of the storage, with no ability to move to the 16GB microSD.

As well as that, Boost doesn't have an OTA for the Crystal, only Sprint. As it stands, I wouldn't update anyway. Not after hearing about "new bloatware." Eff that noise.

First impressions are high for my Crystal, and several people I've shown it to are impressed by the lack of bezels, and the immersive nature of it. I hope it continues to function this well, because this thing is too great.
[Sharp Aquos Crystal] Jayarama:
Agree, it is so beautiful :) I am just using as back to save some battery on my primary phone. I don't have any hopes that sharp going to release unlocked boot loaded...
[Sharp Aquos Crystal] cbsites:
Aquos bootloader

Someone had asked about the bootloader (or installing one). Here is what I get doing 'getprop | grep boot' on the phone.

shell@SG306SH:/ $ getprop | grep boot
[dev.bootcomplete]: [1]
[init.svc.bootanim]: [stopped]
[init.svc.qcom-post-boot]: [stopped]
[ro.boot.baseband]: [msm]
[ro.boot.emmc]: [true]
[ro.boot.hardware]: [qcom]
[ro.boot.recovery]: [0]
[ro.boot.serialno]: [990005270202659]
[ro.boot.wakeinfo]: [65535]
[ro.bootloader]: [unknown]
[ro.bootlogno]: [82]
[ro.bootmode]: [unknown]
[ro.runtime.firstboot]: [1418163324861]
[service.bootanim.exit]: [1]
[sys.boot_completed]: [1]

Note the [ro.bootloader]:[unknown] and [ro.bootmode]:[unknown]. So to me, it sounds like the Aquos has its own non-standard bootloader. Based on how paranoid the security is on this phone, it doesn't surprise me that the would also have the bootloader locked out.
[Sharp Aquos Crystal] vanarebane:
I'm in Europe and I would like to know, if it can be unlocked to be used in the service providers here.
[Sharp Aquos Crystal] Jayarama:
You don't need to publish your serial numbers:)
[Sharp Aquos Crystal] RealZel:
Someone in China found the solution how to make work this phone with local service provider.

[IMG="It works"]http://cs3-1.4pda.to/5475551.jpg[/IMG]

[IMG="lsp"]http://cs3-1.4pda.to/5475579.jpg[/IMG]

This is a source with information and photos: blueshow

More information here: information

More topics here but all in Chineese: topics about 305SH

As I understood to make 305SH work with local provider we need to use "MR-SIM v2" device...

It looks like small psb plate that must be putted between sim-card and phone...

I try to find in China stores like taobao, aliexpress and so on. Nothing.

It is hardware solution but it is better than nothing if its really works...

Maybe someone know about it?
[Sharp Aquos Crystal] vanarebane:
Yes! I have had also this idea now to unlock the SoftBank with this SIM hack.

Probably any those SIM unlockers could basically work:

ebay co uk/sch/i.html?_from=R40&_trksid=p2053587.m570.l1313.TR6.TRC1.A0.H0.Xrebel+sim.TRS0&_nkw=rebel+sim&_sacat=0

just add the needed dots to the url, I'm still below 10 post user.

EDIT: And this one would fit Sharp 305sH/306SH ebay co uk/itm/RGKNSE-R-SIM-8-SAMSIM-Nano-Micro-SIM-unlock-for-iPhone-5-4S-4G-3G-2G-IOS-6-1-3-/140968396682?pt=UK_Mobile_Home_Phones_Sim_Cards_CV&hash=item20d25f078a

Then you need a programmer for this SIM unlocker:

ebay co uk/itm/P-KEY-NCK-MX-KEY-ETC-UNLOCK-DONGLE-UNLOCKING-SIM-CARD-PROGRAMMER-UPDATER-/111227100139?pt=UK_MobilePhones_MobilePhoneAccesories_MobilePhoneDataCables_JN&hash=item19e5a6dbeb

And you basicaly write the SoftBank SIM keys to the SIM unlocker and it will start to mimic the SoftBank card.
[Sharp Aquos Crystal] vanarebane:
Hei, try this one! ;) https // play google com/store/apps/details?id=com.ljmobile.move.app&hl=en

just add the needed dots to the url, I'm still below 10 post user.
[Sharp Aquos Crystal] moonalikhan:
i think R-SIM & SAM SIM will work on the Japanese version 305sH but what about the 306sh will it work or not thats the main question now i hope some one tries and give the feedback.
[Sharp Aquos Crystal] RealZel:
I made order of this r-sim: r-sim 9+

It is smallest chip that can be putted in our devices without problems.

Also I already have this sim card reader\writer: sim card reader

I hope my parcel will come soon and I will write review about this.

Or not if device will be soft-unlocked early =)
[Sharp Aquos Crystal] benny3:
Has anyone try building a rom from source?
[Sharp Aquos Crystal] mofugggz:
stock custom rom

at this point after talking to my developer friend he suggests taking a generic kernel and applying it to the phone rom and flashing it and start picking and choosing what we want to try to acquire root this is way over my head at this point

.
[Sharp Aquos Crystal] whynot4444:
anyone test root by towel root ??
[Sharp Aquos Crystal] Tommy_WOo:
Does it work on Crystal? I didn't see any topic in the official website of R-SIM. Thanks mate.
[Sharp Aquos Crystal] RealZel:
Hi! There are no any confirmation that R-SIM can work with 305SH. I will test it.

Only one topic in Chinese forum have information that R-SIM can work with local service provider. I posted it before.

I hope that my parcel will come soon.
[Sharp Aquos Crystal] Yosmite:
it worked with china 2G network

305h already worked with 2g china mobile and unicom

Only text and calls

Source from sina weibo
[Sharp Aquos Crystal] tewilove:
I have temp root. But not going to share for now. (｡ì _ í｡)
[Sharp Aquos Crystal] Jesseferd:
Then why waste your breath?
[Sharp Aquos Crystal] RealZel:
It is a good news! Hope it will help to find solution to unlock this phone!
[Sharp Aquos Crystal] itsthekidbigc:
Please share how you acquired this, many people are dying for it
[Sharp Aquos Crystal] d@vo:
Please share!!??
[Sharp Aquos Crystal] Muzman:
Image for /system/ and mounting img on start?
[Sharp Aquos Crystal] UltimaXtreme:
Do remember, it said "Sent from my SH-01F" on that guy's post. He either knows something, or he doesn't.
[Sharp Aquos Crystal] LIAM83:
already unlocked for gsm!

Already unlock boost and sprint carriers(unlock cdma for ALL carriers ! people who crack spc/msl know one bug !phone not remember parametrs, with our solution ALL ok voice & data :) now need research with gsm (now gsm unlocked but we have one problem ! phone accept alien sim card but not have signal maybe one apk block signal maybe in phone we not have gsm/wcdma rf nv (its my theory need read all nv and check )! now need sprint phone with original unlock via sprint network i mean 90 days contract (after 90 days sprint officialy unlock gsm networks ! and if i have this phone in hand i sucesfully found solution for gsm signal !!!
[Sharp Aquos Crystal] d@vo:
And, what about Root, nothing yet
[Sharp Aquos Crystal] vanarebane:
I tried it today and can confirm that R-SIM does not fit into the 305SH. The R-SIM chip is on the other side of where the SIM opening is for the phone. I have to either find a way to make a custom R-SIM with the same chip or find another R-SIM like product.
[Sharp Aquos Crystal] onroP89:
The Sprint Version 306SH = CDMA Version, its a different phone, maybe it has a GMS module but so far, its not 100% sure.

Japan 305SH = GSM Version, BUT locked to SOFTBANK i ask em via Email if they unlock the Phone for Money, they dont.

You need the Japan Version, if you want a working 100% working GMS Version. And than you still need to unlock it to use a different provider.

If you use the US Version 306SH you need to root it, active the maybe existing GMS module and than hope it works.

I hope you mange to get it work, i will donate :D

So why you even Post it?

I have a Time Machine, i just used it, the future told me ur lying.
[Sharp Aquos Crystal] vanarebane:
Here are photos from inside the 305SH. Can anyone unscrew their 306SH and confirm that they have the Skyworks SKY77629-21 chip in it. Then you can confirm if the US version has GSM capabilities.

You need special screwdriver. But I found that the Apple larger 1.2mm pentalobe worked also on the screws when I applied pressure while unscrewing.

Quite easy to open. Also a beautiful phone from the inside! And they would have installed micro-SIM easily in that phone :silly:

And the battery is between LCD and Mainboard. This makes changing battery very hard :(

[IMG="Innerts"]https://photos-5.dropbox.com/t/2/AABJwCgOSGSWI11niM_CSszaR3o3mRPqD5jBqTrA_gs4aw/12/248295882/jpeg/1024x768/3/1419343200/0/2/sharp%20305SH%20inner.jpg/CMrjsnYgASgB/qZb3vG7bk7Hy-FGAhd-erR6iZyLHnSI80NOhovE6Tnk[/IMG]

Full size: https://www.dropbox.com/s/rl47c79brnjl626/sharp 305SH inner.jpg?dl=0

[IMG="Chips"]https://photos-5.dropbox.com/t/2/AAASUtEXN3h2r69xX4ezo_p0DuYBkiXcS-rxFE5rDvbHLg/12/248295882/jpeg/1024x768/3/1419343200/0/2/sharp%20305SH%20chips.jpg/CMrjsnYgASgB/0imjfeO6runvNU_Yq9Cnrj52oRgk0xH5v--kMh_Fyg4[/IMG]

Full size: https://www.dropbox.com/s/kq32fn60kog7u1z/sharp 305SH chips.jpg?dl=0

As of my understanding. Someone hinted, that the phone unlock code is in one of the chips.

So one of my hypothesis is that if the Qualcomm WTR1625L world mode RF transceiver is replaced, the unlock code should be also removed...

Anyone can comment on that? :angel:
[Sharp Aquos Crystal] Muzman:
tewilowe, last time had not noticed your nickname.

Just write in case you need additional tests on sh-06e (1.00.10).
[Sharp Aquos Crystal] RealZel:
Hello! Today I received r-sim 9+ and tested it with mine 305SH.

Maybe I received broken one but it is not work on 305SH and other my phones.

Looks like sim-card not inserted.

I have no iphone to check this r-sim but I can say that my r-sim 9+ is not work on 305SH.

---------- Post added at 04:09 PM ---------- Previous post was at 04:04 PM ----------

This is a photo that Tewilove posted on his blog:

[IMG="root"]http://ww3.sinaimg.cn/bmiddle/6594afb3jw1end3b0y8mdj20se0e2ael.jpg[/IMG]

Source: weibo
[Sharp Aquos Crystal] vanarebane:
Did you insert the R-SIM the right way? Check the notch on R-SIM, it's next to the chip. The SIM must go in so that the R-SIM chip goes in first. Meaning, that it's not possible to enter it. The only way you could have inserted it was inserting it the wrong way.
[Sharp Aquos Crystal] RealZel:
R-sim 9+ have chip in the middle of the plate.

Position was correct... I checked a lot of times this thing.

Photos:

Pins on r-sim

Chip of local sim-card (position is correct I checked it)

------

BTW I found Chineese manual how to make this phone work with local service provider.

Source is here: link

Some steps from that manual.

1. At first you need to have sim-card reader\writer and get information from local sim-card.

You need to get ICCID, SMSP, IMSI and KI (not all sim-card can be hacked)

2. Than you need to have phoenix (Mr.Sim?) blank sim-card and put there information from original sim-card

3. Change service provider ID to SofBank Type2

4. Install sim-card to 305SH and use.

Names of software that you need: "MrSimOne" and "MrSim"

Unfortunately I have no phoenix sim-card and I can't try this solution right now.
[Sharp Aquos Crystal] vanarebane:
I see, you have the chip in middle. I used R-SIM 9 PRO.

You should be able to rewrite the R-SIM code with a dongle. They sell their own dongle, but I'm sure that you can use other generic USB-SIM Dongles as well.

http://www.rsim5.com/productview.php?id=32

I try to find phoenix Mr.Sim. I also have a regular USB-SIM writer, so maybe I can hack some other SIM card with that.

Thanks for your hints.
[Sharp Aquos Crystal] vanarebane:
What is NV lock? And by saying that the lock is in android system, means that when you flash android ROM, you should get rid of the lock?

Or maybe you can develop some APP that tricks the Android into thinking that it has SoftBank SIM card?
[Sharp Aquos Crystal] Yosmite:
no way of getting this work

Im Chinese . This method can only use on China mobile 2G sim card and the sim must be produced before 2009. :rolleyes:
[Sharp Aquos Crystal] LIAM83:
I never create this for japan version becase i hate fuc...g japan phones every time this phones have problem with security( i remember my first softbank samsung big headache) we know japan phone like softbank or foma its truly piece of shi...t not ask me this!! only sprint or boost maybe virgin ( virgin too have good security but its crackable))) About lock in NV i explain lock in nv have many samsung and lg phones but i think in this phone we not have lock in NV i not tell you this 100 % its only my IMHO (i already unlock this phone but i not have signal )!
[Sharp Aquos Crystal] vanarebane:
Yes, I found out it myself when tried to unlock the SIM. To find the SIM KI, it's like impossible to crack.

Still don't understand what you mean by NV :)

My question lies still.. if Yosmite was able to get it working with really old SIM card by changing the carrier name. This is basically what the R-SIM is doing, right? When the Phone asks for the carier, the R-SIM steps in and says that the carrier is SoftBank, and youre in. If someone can find any firmware of anything on R-SIM logic that could help, I might start hacking.

You did try it in Sharp, but as I understand, the R-SIM works to fool the iOS. There are different firmwares for different iOS versions. So for Sharp, you would need to flash a whole different firmware. Or am I wrong here?

Basically... with this kind of tool (http://bb.osmocom.org/trac/wiki/SIMtrace), we would be able to develop or own R-SIM for Sharp

And here is a even cheaper one http://rebelsimcard.com/fully-assem...and-mobile-phone-hex-scan-en.html#.VJs5ul4gOs