yashsingh1/xdaforums huggingface dataset:
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
I pulled like 11 addresses in Cdma Workshop... The blog post you referred to in the guide said after 8 hit stop.. I was kinda confused on that.

I was NOT in AirPlane Mode.

My baseband is: 2.15.00.05.02

This post:

http://cdmagurus.com/forum/archive/index.php/t-4902.html?

references a fix on the last post...

".....the way i got around it was to send command password xxxxxxxxxxxxxxxx. where xxxxxxxxxxxxxxxx is your sixteen digit hex password."

not sure what the "sixteen digit hex password is"

kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
Scan the addresses. Don't stop the scan. Write down the addresses. Scan again in airplane mode. If there are any new addresses write them down. In qxdm go to the addresses write them and do it again in airplane mode. If you reset and the numbers come back you missed one. It may take a couple tries to get all of them.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
CDMA Workshop crashed out at:

Process is stopped at: C000:0000

Ended up with 14 addresses... in AIRPLANE MODE

Tried it several times..

Which is cool.. there is probably no ESN's past that point.. BUT... QXDM is still greyed out in the memory viewer... :(

Kevin
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
Then you must not be connected to qxdm. Close qpst and qxdm. Open qpst and make sure you are connected. Now open qxdm and go to connections and choose your port.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Did a couple reboots (phone & pc).. and got it back to writing...

OK.. Did a re-scan of addresses on Cdma Workshop, found 18!

Put them in QXDM, but only found ONE MEID out of all those 18, and zero'd it out. I found several ESN's and zero'd them out.

Rebooted the phone, hit ##786#

I see that the ESN is all ZERO's.. Whoo Hoo!

But.. the MEID is unchanged. So I guess I'm half way there... lol

I guess my main question is:

Are there seperate addresses to scan for MEID numbers? And if so, how do I do that?

I do really appreciate all your help.

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
try this

Step 6. Now the memory tab in the "Memory/Eeprom" area, enter the beginning of the address range in the Start box "00FA:0000" and "296124 bytes" in the "Size (bytes)" box. Now click "read" it will ask you to save to a file. Do this for "BOTH REGIONS" you scanned. The second region will likely take a while. The range address are "0108:0000" and "13500000 bytes".

or try these:

0X00FB45A0

0X00FD5960

0X00FE0520

0X0015EFF30

0X0015EFF20

0X0015EFF30

0X0017C9ED0

0X0018F21A0

0X001902430

0x00cd3f39

0x001d63e30

0x0018f2280

0x001d63e40

Another thing I do to make sure I get them all is I scan each address in QXDM then scan again in airplane mode, scan again without airplane mode, and scan one more time with airplane mode.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Wow that MEID was a stubborn mfr! It was all over the place!

I did get it all zero'd and changed though! Text and Voice are now ported and working!

Here are the addresses used:

//edited for qxdm memory search

ESN's:

0x00FD2DC8

0x00FD4694

0x00FE581C

0x00FF581C

0x0127DCCC

0x015FAD48

0x0179FFA4

0x017C9A1C

0x017C9E7C

0x017D0338

0x0188D6BC

0x01D5E1D1

0x01D5E37E

0x01D6A551

0x01D7F6C1

0x01D6A6FE

0x01D6A6D7

MEID's

0x00FB45AC

0x00FD5968

0x00FE0528

0x015EFF2C

0x015EFF38

0x017C9ED0

0x018F21AC

0x018F2288

0x01902438

0x01D63E2C

0X00FB45A0

0X00FD5960

0X00FE0520

0X0015EFF30

0X0015EFF20

0X0018F21A0

0X001902430

0x00cd3f39

0x001d63e30

0x0018f2280

0x001d63e40

Some were close enough to NOT have to use 2 (like: 0x00FB45AC, 0X00FB45A0) but I just went through every single address I could find (on my own, and through researching)

Now.. on to DATA... ;)

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
What phone are you using and what service provider are you porting to?
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Donor is LG Optimus V

Using the Evo on VM
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
Not sure if your aware but no one here has been able to get data or picturemail to work so if you do somehow figure it out let us know how.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
There HAS to be a way... I'll let you guys know of anything I find out

Kev

---------- Post added at 03:56 PM ---------- Previous post was at 03:52 PM ----------

I'm trying to dig a little deeper into my Optimus V to get some settings, etc.. That they locked the OV up pretty tight...

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
See if you can put an optimus s rom on there and use dialer codes to get settings.
[EVO 4G Q&A, Help & Troubleshooting] teh roxxorz:
Have not been reading the thread, but fairly certain that an optimus S rom won't work on an optimus V.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Doing it now..

Just finished a Nandroid backup

Downloaded a Stock Optimus S Rom

I'll let you know what happens.. :)

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
Someone else on here said that they did get a sprint rom on their optimus v. They said they would try it again but haven't posted back yet.
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
If anyone can get the .apk file from a virgin rom that does the automatic setup that might help as well. I'm going to download a virgin rom and see if I can find out which apk it is.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
So.. Today..

I was talking on my Evo today.... It got super HOT, then died.

Now it won't come back on... :(

Any Ideas?

Kev
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Nevermind...

The damn battery died... LOL.

I assumed it would actually CHARGE in "Charge Only" mode plugged into my laptop... (My OV did great!) It actually died WHILE PLUGGED IN to the laptop...

Apparently, the Evo doesn't charge well through USB.... lol

I thought I done burned the EEPROM up!

Kev
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Got an Optimus S flashed on the Optimus V! .. BUT, there is no data.

Good news is.. the dialer codes DO WORK. Settings to come in the next post

Kev

---------- Post added at 04:01 PM ---------- Previous post was at 03:39 PM ----------

Ok.. Here are the settings...

Dialed ##DATA#

Data Profile:

Username: MEID@mdata.vmobi.com

Rev. Tunneling: 1

HA SPI: 8687

HA Password: HA Passord (that's what it says)

AAA SPI: 8687

AAA Password: AAA Password (again, that's the actual setting)

Device IP: 0.0.0.0

Primary HA IP: 0.0.0.0

Secondary HA IP: 0.0.0.0

Browser:

UaProf URL: http://device.sprintpcs.com/LG/LS670/latest

MMSC:

Set URL: http://mms.sprintpcs.com

Multimedia:

RTSP IP Address: 0.0.0.0

RTSP Port: 0

Http IP Address: 0.0.0.0

Http Port: 0

EVDO:

DDTM: ON

HDR Pref: Auto

Advanced:

Meid: (my MEID)

ESN: (my ESN)

P_Rev: 6

Vocoder: EVRC

EVRC_B: Enable

SCM: 058

Slotted Mode: Enable

Slotted Index: 2

Home NID: 04139

Home SID: 04139

MCC: 310

MNC: 00

ACCOLC: 5

Home Sys Reg: Enable

FSID Reg: Enable

FNID Reg: Enable

LBS IP Address: xxx.xxx.xxx.xxx (that's the setting)

LBS Port: yyyy

Device Self Service:

DSS Server URL: (no setting here)

DSS Proxy IP: 0.0.0.0

DSS Proxy Port: 0

And that is the entire section of ##DATA#

There seem to be alot of "0's"... And again, I have NO DATA on the device with the Optimus S Rom.

Which has me thinking... Is it in the ROM itself? And if so... I wonder how hard it would be to put a Optimus V Rom (or maybe the Motorola Triump Stock Rom) on the HTC Evo? OR.. Maybe like you said... Trying to find the actual VM Activation APK... ... Hmmmm

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
Hmmm. It seems the sprint rom changed your data settings. This probably wont help but try ##786# and do a reset. If we can find the activation .apk we might be able to put it on any phone and activate it.

Does anyone know how to do a full system dump?

Right now it seems the boost $15 a month data plan is the way to go using apps for calling and text.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
I found a copy of the VM Activation APK....

Self-Service Assistant APK

http://www.mediafire.com/?z2odcbxfm6cxjw8

Coundn't get it to work on the EVO.. It would run through the process, then give an error and number to call VM

Kev
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
So.. here's what's going on so far..

Before I flashed the Optimus S STOCK Rom, I did a nandroid back up of the Optimus V rom (CM7) I've been using..

I flashed the OS STOCK Rom.. Dialer Codes DID WORK, but Data did not....

Got some settings from the OS Rom using the dialer codes, then did a Restore of the nandroid backup from earlier...

When it restored, the Data DID NOT WORK on my original rom (CM7)..... Telling me the OS STOCK Rom definitely changed some of the data settings....

Found and downloaded the VM Activation APK, tried it on the EVO.... and tried it on the newly restored backup... neither worked. (I'm thinking it may only work on Android 2.2)

Found and flashed a completely STOCK OV Rom... It immediately requested I "activate" via the VM Activation (1.....2.....3..... )

Rebooted. And the OV STOCK ROM Data was working fine! Hmmmm

So then I did another restore of my OV (CM7) rom... (The one I started with) And the Data is working on it now!

Friggin WEIRD...

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
When you installed the sprint rom it changed the data settings and the only way to get it back is to reactivate with the virgin apk. Have you tried installing the sprint rom and then put theactivation apk on it and try to activate?
[EVO 4G Q&A, Help & Troubleshooting] -EViL-KoNCEPTz-:
For you cloning is illegal whiners the law was specifically amended to exclude using a phone you own to clone another phone you own as long as both devices are yours its completely legal, just like rooting its your device you can do whatever you want with it including banging it against your head to make the smart from the smartphone go into your pea.brain

Edit: let me clarify phones that you legitimately own and have clear esns not a phone u bought with a bad esn that is still frowned upon under the law, its kind of a grey area

Sent from my -EViLizED-EVO-
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Yep.. Tried that too. Immediately force closed upon starting it....

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
There must be some additional files we need or something. Maybe we can try making a hybrid rom. I'll try combining the files from the virgin rom with my sprint rom and see what happens.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
That's exactly what I was thinking...

Kev
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Are HA and AAA Secrets "phone" specific or "account" specific?
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Having all kinds of problems pulling the HA and AAA codes from the Optimus V... From what I'm reading, it's damn near impossible. LG/Virgin locked that dude up pretty tight... Again, from what I'm reading... the Intercept is the ONLY phone in VM's lineup that will work with this process we're trying...

So.. I'm going to do an ESN swap with my old Samsung Intercept, activate it, get 3g up and running.. flash the MEID over to the Evo...then pull the secret codes from it..

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
This will also let us know if the AAA password is device specific or service specific.
[EVO 4G Q&A, Help & Troubleshooting] ejoy:
It's not an EVO 4G, but a Shift, nonetheless, someone else has flashed a phone to Virgin Mobile and has got everything working, there has to be a way!

http://xdaforums.com/showthread.php?t=1204836
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
I don't get it... I've read in several places that the Intercept is the only phone to use to pull those codes...

But...

This thing seems locked up tighter than any phone I've plugged up!

Cdma Workshop barely reads it... Almost all options fail. Phone didn't answer.

QPST just recognizes the port.. That's it. When you launch the Service Programming, it won't read a damn thing... When you try it just says The phone stopped responding to yada yada...

QXMD about the same... It will take the SPC, but EVERY OTHER COMMAND get's a "Error recieved from target" bull****....

I gotta be doing something wrong....

Kev
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
I FREAKIN DID IT!!

A 3g working HTC Evo on Virgin Mobile!

Ok.. So here is what I learned today... And this is what did it.

HA Shared Secret is all the same on VM: "vmug33k" is the password. When using QPST, on the M.IP Tab, when changing the profiles/entering the passwords.. make sure you change it "text string"

Now.. The AAA Shared are definitely PHONE specific!

From the Intercept, you can find it in NV Item 466_1. It will be a text string 10 characters long. Use HxD Hex editor to read it. (See Screenshot 3 Posts down)

Any questions just ask!

I'll probably make a video explaining it in further detail for you guys... You guys (especially you weinerwad3000) have been a HUGE help and I really do appreciate it!

Kev
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
SPEED TEST RESULTS:

Test Date: Nov 22, 2011 11:40:17 AM

Connection Type: EvdoA

Server: Saint Louis, MO

Download: 1.09 Mbps<------------ Not too bad! Better than I ever got with OV

Upload: 0.54 Mbps<---------------About on par with the OV

Ping: 133 ms<--------------------Same.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Proof Video:

http://www.youtube.com/watch?v=Em_TC5AzMXI

I also have the Evo ROOTED, S-OFF, and running the latest MIUI Rom! :)
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
The HA shared secret is: "vmug33k" (text string) This is standard on all VM phones, and will actually get you 1x Speeds.

The AAA is going to be located in one of your NV Items.

Use QPST, launch the EFS Explorer, goto the NVM folder and pull these keys (copy and paste) to a folder on your desktop:

465, 465_1, 466, 466_1, 1192, 1194

Use a program called HxD Editor to read these items.

On the Intercept, the AAA is located in 466_1... Again, not sure about the other VM phones.

When viewing with HxD, look for an NV item with "vmug33k" on the right.. Under it will be your AAA Key...

It will look like something like this:

Now you have both keys!

Input/Write these keys onto the new phone in QPST/Service Programming/ Under the M.IP tab. Making sure to match ALL information in this tab with the donor. Also, make sure when entering the keys to switch it to "text string"

Think that should get it!

Any questions just ask!

Kev
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Did you guys get your 3G figured out and fixed? This thread seemed active, until I posted that last post... lol.

My last step in MMS.. It's been a pain. So far I'm half way there.... I can send MMS, but not receive. Apparently VM uses a special MMS.apk to do this... been hard to port.

Kev
[EVO 4G Q&A, Help & Troubleshooting] monkeychef:
Great work man.
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
Congrats, now if only we can use other phones as the donor being that the intercept is so damn expensive. I haven't had time lately to fool around with the optimus virgin rom to try and get it working on the optimus s but ill post back as soon as I can.
[EVO 4G Q&A, Help & Troubleshooting] monkeychef:
In theory, could I do this with an Epic 4g Touch? My friend wants the latest smartphone he can get (unlocked and cheap) but he doesn't want to pay out the @$$ for his service, and Virgin is a perfect choice for him.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
For the Optimus V, we really just need a way to read the NV Items and get the AAA shared right? Ill plug my OV up and try a few things.. I remember last time plugging it up, CDMA Workshop wouldn't read the needed NV items, kept putting "access denied" in the memory dump...

Kev
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
My problem is I'm trying to use a rumor 2 as the donor phone. That's the only virgin phone i have. What I'm currently doing is trying to find a way to put the optimus v rom on my optimus s or just an activation apk to get the phone activated on virgin and then pull the passwords off of it. If you have an optimus v you should be able to go into qxdm and type requestnvitemread ds_mip_ss_user_prof 0 and requestnvitemread ds_mip_ss_user_prof 1 to get your ha and aaa. Not sure about how to get the picturemail working however.
[EVO 4G Q&A, Help & Troubleshooting] theonebakery:
Move to Development

It's great to see this working! Maybe you should move this project over to the Dev area to get some help!
[EVO 4G Q&A, Help & Troubleshooting] -EViL-KoNCEPTz-:
Check the.optimus forum at sdx they should have a v rom for the s model so u can get it up on virgin I know they had several for the intercept that had been modded to run on dl05 instead of the e__6 can't remember the virgin number off top of my head so they might have what you're looking for for the optimus

Sent from my Classic-EViLizED-ToMAToFiED-EVo4g-
[EVO 4G Q&A, Help & Troubleshooting] poop9711:
sprint baseband?

@alexanderkr1 did you have to flash the sprint baseband to the intercept to read the memory? I can't seem to read anything off of it. I read somewhere that the sprint baseband helps but I don't want to do anything irreversible unless necessary.
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
I didnt flash anything to the intercept.. I had all kinds of problems reading the intercept too. CDMA Workshop gave errors, as did qxdm.. EDIT: Make sure you dial ##port# and enter the MSL, and take both options off PDA! (I'm posting this off memory, its displays two sets of options.. choose the top one on both).... Really, the only thing you need off of it is the AA Shared Secret. Which can be read in NV item 465_1. Use Qpst's EFS Explorer to read it. Check out my post about it... think its on page 12 of this thread.... forgive me for being short. I'm actually replying from my EvoVM ... my name for the new Frankenstein. Lol.. If you have any more problems, just post it here... I wanna help. Lots of people on this thread helped me tremendously, I wanna give back.

Kev
[EVO 4G Q&A, Help & Troubleshooting] poop9711:
AAA

Hmm.. I couldn't figure out how to read the NV items so I eventually just gave up.

But then I found that for the Intercept you can easily read the AAA shared secret using logcat.

Here's how...

Prereqs: adb and usb debugging and MSL

1. Go back to ##PORT# and change the second option back to PDA so you can use usb debugging.

2. Install Any Cut and create a shortcut for DATA (choose the 2nd DATA in the list - it should allow you to Edit)

3. Connect your phone to usb and from the terminal (or command line)

type: adb logcat > logcat.txt

4. Then using the shortcut you created on your phone with Any Cut - hit edit and edit your username but don't change anything.

5. Then Ctrl-C on your logcat screen.

6. Look through the logcat.txt file for "aaa_pw:" and "ha_pw:"

They should be there.

@alexanderkr1 So I thought I needed to read stuff from QPST to set the MEID on the EVO, but I guess I don't??

Is this all the info I need?

MEID

AAA pw

HA pw
[EVO 4G Q&A, Help & Troubleshooting] alexanderkr1:
Yes. If you have those 3 things from the donor, you're all good.

Do you have calls/text working yet?

If not, you need to zero out the old meid/esn from the Evo and flash the one from the donor. There is instructions throughout this thread on how to do that.

To get the data working:

On the M.IP. tab in QPST (Service Programming) These are the settings to write to the EVO:

profile:0, enabled:no, nai:, tethered nai:, ha spi:3, aaa spi:2, rev tun:no, home:0.0.0.0, primary:dynamic, secondary:not set, dmu pub:0, mob auth:

profile:1, enabled:yes, nai: (DONOR MEID)@mdata.vmobl.com, tethered nai:, ha spi:21EF, aaa spi:21EF, rev tun:yes, home:0.0.0.0, primary:not set, secondary:not set, dmu pub:0, mob auth:

HA Shared: (change it to "text string" and enter "vmug33k")

AAA Shared: (change it to "text string" and enter DONOR AA Shared Secret)

profile:2, enb:yes, nai: (your MEID)@prov.vmobl.com, tethered nai:, ha spi:21EF, aaa spi:21EF, rev tun:yes, home:0.0.0.0, primary:not set, secondary:not set, dmu pub:0, mob auth:

HA Shared: (change it to "text string" and enter "vmug33k")

AAA Shared: (change it to "text string" and enter DONOR AA Shared Secret)

Write to Phone!

Hope that helps!

Kev
[EVO 4G Q&A, Help & Troubleshooting] poop9711:
Evo 4G

My phone finally came and I finally got it flashed over to Virgin.

So just to fill in the blanks a little on what I did for other readers.

First dial ##virgin# on your activated phone to get the MDN/MSID so you have that to put in your new phone.

For Evo's with hardware versions less than 0004 there's a really easy way to

zero out the meids.

Google "Easiest way to repair meid" on the Evo from on cellphone-gurus to get the information. It's the first page.

Then use qxdm to write the new meid. Then do ##MSL code# on your evo to input the mdn/msid. I had to factory reset the evo to get that to work correctly.

From there just follow Kev's instructions above to get 3g working.
[EVO 4G Q&A, Help & Troubleshooting] fenixgoon:
hey guys, i'm trying to flash an Evo 4g over to VM and this thread has been super helpful.

so far here's the info i have on my donor phone (VM samsung intercept):

ESN/MEID (both Hex and Dec form)

PRL version # (not the list)

MSL code

i am using the Incredible-->Boost guide (found here) as a guide.

right now i appear to be on step 2 - reading the NV items. i tried using CDMA Workshop to get the PRL to connect to my donor phone but the phone never responds - i get the error " failed..phone does not answer"

any idea why this might be? am i using the wrong tool? i also have QPST/QXDM at my disposal, but am not very familiar with how to use them.

thanks in advance!
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
That guide is a little confusing. It seems like step 2 and 5 are the same just different methods. If all you need now is data just do step 5 to get the AAA password and make the mip tab match your intercept.
[EVO 4G Q&A, Help & Troubleshooting] atchoufong:
Hi,

First of all, I would like to thank everyone that made it easy to flash phones over to VM.

I have followed this tutorial using the Epic 4G, and managed to get the text and call working, but not the data. Is it the same settings for the Epic to get the data working?

I am using an intercept as the donor, but QPST doesn't read the phone, so I don't have the settings I need to write on the epic, other than the ones in the tutorial. If anyone can help, I would like to know all the settings from the M.IP and the PPP tabs. I have my HA and AAA password.

Actually the 3G sign appears some times, the data works for like 1 minute, then it disappears. Maybe there is just a little setting that I need to fix.

So please if anyone could post screenshots of the exact setting I need to put to get the data working, that would be greatly appreciated.

Thanks,

John
[EVO 4G Q&A, Help & Troubleshooting] weinerwad3000:
How did you get your ha and AAA password if the intercept wont hook up to your comp? Do you have the proper drivers installed? Can you connect to cdma workshop? If you have the ha and AAA password try dialing ##data# and put in the AAA and ha password and restart the phone. Since this is your first post I assume you're new here. If you need more help just pm me and ill do my best to help.
[EVO 4G Q&A, Help & Troubleshooting] atchoufong:
Weinerwad3000 thank you for the reply.

The VM Samsung Intercept is a pain in the back to read. I followed a tutorial, and managed to get the AAA password, and I am 100% sure it is the right password. I have done the ##data# thing on the Epic and put in my AAA and HA password, but it is still not working. Like I said above, The data works sometimes, for like a minute, then it disappears, and comes back again randomly. So I am sure there is just a little detail that I am not doing right. I will pm you screenshots of my settings under QPST, and hopefully, you will find what I am doing wrong.

And yes, I am new here. Been reading posts for a while, but only managed to post something yesterday.