下班之前转一篇，回家再细看

EricHoo

from http://mobile-files.com/forum/showthread.php?t=111961&page=8
, W5 E. e8 t! T. D
! o6 E% L2 `9 H, A5 L' kEVDO working on Sprint!

This procedure is tested to work on Sprint only. This assumes you have working 1xRTT already. If not go back and get that working first!
- [8 N8 H, H; a" y. ^. q% B; f
6 g# D0 ]$ N% D8 R' T3 AObtain your 16 byte CHAP hash. If you don't have it, it is probably located in NV location 1192 in the original phone.

  Y# u; \) X% ~+ S& h4 DWrite it to location 1192 in your Pre. I recommend using PmModemFactory, but you can do it however you prefer.
5 e! y! L3 N% q! H' Y
In the following example the hash is (hex) 0102030405060708090A0B0C0E0F10. You must convert it to decimal bytes in order to write using PmModemFactory. The first byte is always 10/16 (hex/decimal) as this is the length pointer:

' S: i2 P$ g1 H; qCode:
: u, @" k. J! r& P7 t3 Proot@castle:/# PmModemFactory -p 000000
0 R9 ], R) _% |$MODEM MODEL=CDMA   
8 O! c; ]$ i( c( R5 h$ l$FW VERSION  =CC1.1(90)
5 s5 }8 A. n3 _2 E( ASPC = 000000
% x, W# _  T) T- n$ U$MODEM UNLOCK SUCCESS
root@castle:/# PmModemFactory -n write 1192 16 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16           
' u+ Y  q& a- v# Q# I! i. ]& ~$MODEM MODEL=CDMA   
& X1 F, F* L  c, R6 ^( x: C$ z$FW VERSION  =CC1.1(90)
6 [( J0 v/ x7 t/ {. u$ NV DATA= 0X10  0X01  0X02  0X03  0X04  0X05  0X06  0X07  0X08  0X09  0X0A  0X0B  0X0C  0X0D  0X0E  0X0F  0X10  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
/ V8 l' w9 o: E0 H$ M$NV WRITE SUCCESS!
; z/ H3 e" ]  m/ n0 C" g$ c5 v0 [You should also verify that location 1194 is set to {your meid}@hcm.sprintpcs.com:
- I  b4 z9 f% H# x9 e( S
Code:
1 t: f( R4 j1 U5 }7 H6 Xroot@castle:/# PmModemFactory -n read 1194 1
% M/ |2 d0 [0 i% L$ NV Item 1194 Read Slot 1!
" I# u) k4 {2 N9 C; X( [$MODEM MODEL=CDMA   
$FW VERSION  =CC1.1(90)
$ F8 T# e' I+ ?8 c4 X- @% U# D$ NV DATA= 0X20  0X41  0X31  0X30  0X30  0X30  0X30  0X30  0X30  0X31  0X32  0X33  0X41  0X42  0X43  0X40  0X68  0X63  0X6D  0X2E  0X73  0X70  0X72  0X69  0X6E  0X74  0X70  0X63  0X73  0X2E  0X63  0X6F  0X6D  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
$ NV READ SUCCESS!
9 q  e- Z' s4 Z3 f% vNote the first byte is 0x20, if it is anything else, something is wrong! Decode the remaining bytes to ASCII and you should get A1000000123ABC@hcm.sprintpcs.com, with your MEID instead of course.

# N! O1 R+ e8 _/ X5 C* ^If everything is good, Put your Pre in diag passthrough:

Code:
- d4 ~: a# e2 I- P9 t0 Oroot@castle:/# mpt d  
** Message: serviceResponse Handling: 2, {"returnValue":true}
# s9 j: I+ P. M. B* OPass-through enabled for Diag
Fire up QXDM. I used version 3.09.19 for this procedure. Connect to the COM port for your Pre's Diag. Verify "streaming" shown next to the command entry box at the bottom.
7 {) `; Y) Z# t- D- v
7 ]! g8 l3 s/ W, xOpen the Command Output window. Issue your SPC by typing spc 000000 (substitute your SPC here). The command output window should show:

Code:
$ V3 f( t: @4 L0 I06:43:30.000 spc 000000
7 e* h% l# r1 p06:43:30.000 RequestItem "Send Service Programming Code Request" 0x30 0x30 0x30 0x30 0x30 0x30
+ K0 s- X' p# ?) l06:43:30.030 DIAG TX item:
06:43:30.030 Security Code[0] = 0x30
06:43:30.030 Security Code[1] = 0x30
06:43:30.030 Security Code[2] = 0x30
06:43:30.030 Security Code[3] = 0x30
06:43:30.030 Security Code[4] = 0x30
1 w9 X& V) q3 R06:43:30.030 Security Code[5] = 0x30
+ R$ V. ?  Y4 j* Q06:43:30.140 DIAG RX item:
# [5 A6 s0 P" O$ i9 A9 @) j06:43:30.140 SPC Result = Correct
: p% T' I$ F& A% w  pNow open the Memory viewer, you can do this by hitting F4. Choose 2 rows from the drop down on the right and type 0x009D311C in the address box on the left. Click on the first hex byte in the window, and make sure it's 10. Then carefully enter the 16 bytes of your hex hash, and double check to be sure it's correct. The last byte should be the first value on the second line if you type all 16. If all is well, click the Write button.

* N, W2 N/ F: S9 S* R* XClose QDXM and then shut off passthrough:
) H/ c8 a" R" E! p6 v, d; D
Code:
' @, w( J, V# }* Aroot@castle:/# mpt x
& W' U' J) s3 M- A, U% f* F** Message: serviceResponse Handling: 2, {"returnValue":true}
Pass-through disabled
. R5 B$ I6 ~3 x( V+ ~% `If you had previously set your data mode to 1xonly, now is the time to reset it to hybridreva. You can use TilIpcTest to do so, choose 41, then 209.
* |: P3 n/ c& O' s( }! C/ b" d
If your data mode is set, lets now use TilIpcTest to reset the modem and watch the Dbus messages:

Code:
root@castle:/# TilIpcTest
) s1 D+ I4 ^' Z8 m; p! D** (process:3920): DEBUG: Registered object path: Client com.palm.phone /com/palm/phone
** (process:3920): DEBUG: Registered object path: Client com.palm.phoneN /com/palm/phoneN
5 J; W! \0 d( B** (process:3920): DEBUG: Run loop client.
** (process:3920): DEBUG: Run loop client.
** (process:3920): DEBUG: Registered object path: Client com.palm.bluetooth /com/palm/bluetooth
* P$ U) y/ O$ A" S; B
TELEPHONY Test Menu
2 M8 l( `. w: n1 K( Q- @1 : Power ON
2 : Power OFF
3 : Dial Call
4 : End Call
" x# s+ D6 A, j, a( a5 : Answer Call
6 : Conference Calls
7 : Extract  Call
8 : Swap Calls
9 : Send DTMF
5 P) R- j* m0 V9 Z0 C5 W0 v3 S10: Send SMS
11: Gps Get Fix
# j& p& W3 }# e% U  o0 ]12: Gps Cancel Fix
) ]+ x# Q. G3 h0 W& N. l- ^* X13: EMPTY
14: Gps Clear
15: Gps Logging
16: Set Audio Profile
1 A) \- v; x: b4 m5 A: ?17: Get Audio Profile
9 s: K  _7 G" K- e% z) U7 G$ W18: Set TTY Mode
19: Get TTY Mode
4 C+ w' K& P. V/ G20: Get Flight Mode
21: Start Continuous Dtmf
22: Stop Continuous Dtmf
23: Bluetooth Menu
24: Send Ussd
6 V- w* [! T1 S5 Q& j7 l% u25: Set Voicemail
26: Get Voicemail
0 i( s; C! U8 z: O$ @0 z' T6 A! H' p27: Set Callforward
5 T# \# ]- @- W6 O" Q# u28: Get Callforward
7 T- F5 s# S7 j) V% n29: Set CallWait
30: Get GetCallWait
31: Set SMS Delivery
: B. t. x7 K7 a! w32: Set SMS Msg Service Options
33: Get SMS Msg Service Options
34: Enter Radio Debug Mode: [enable/disable]
. t& ~- _8 B; K6 {6 d35: Enter Program Mode
, C. q: b* c4 R( r36: Exit Program Mode
6 O) O4 c+ \6 g; q/ R7 I37: Get Activation Info
38: Set Activation Info
39: Set ForwardingStatus
; M) s2 G% o) @. |& f! e5 ]40: GetFwCarrier Db values for GSM only
* ^9 }) i; X' w41: Go To CDMA Misc Test Menu
2 m7 \6 P1 {9 A) P! T42: Gps Test Runs
43: Get CLIR settings
44: Get CLIP settings
45: Restore Radio NV Defaults
) Q; d6 o  g: E' ]4 I! U3 z46: Get PDP Profile
47: Set PDP Profile
: @0 L3 g9 Y1 N/ @" E48: Set Active Line
49: Get Active Line
50: Get Network Band
+ ?( w1 p6 p' h0 b. d51: Set Network Band
# g( L- M! I" S* t$ g6 `  t52: Reset Radio
53: EMPTY
54: Lock phone
55: Unlock phone
56: Get phone lock state
& `( ~- \$ I5 A5 y3 {1 s57: Change phone lock password
58: End Emergency Mode
59: Exit TIL
60: GetDtmfDuration
- ]) X. T& _6 E3 g. ^61: SetDtmfDuration
62: Charging
% C; u1 w0 Y, i8 `; ?63: Get Active PDP
7 h7 K3 N5 u+ f8 ]: S64: Set Active PDP
65: Activate Til
66: Send Flash
67: Enable Sending RSSI
, p1 V% ?- Q2 n68: Disable Sending RSSI
69: Gps Get/Set Location Privacy Mode
70: Mute
71: Unmute
72: Get Provisioning Status
2 y1 w, g8 ?: a2 M/ E7 h73: Get Charging Support
0 G$ y5 G  J2 F+ J+ e+ C) l74: Get IPC Interface Version
75: Set Mode Preference
8 R, }, l4 U5 f76: EMPTY
77: Set Call Barring Status
78: Get Call Barring Status
79: Change Call Barring Password
80: Suspend enable/disable
( D2 t# @' Y+ O4 k$ b1 Q  F! x81: Send HardCoded UCS2 SMS for GSM only
82: Set Audio Modem Tuning Params
! |. {2 N4 Q8 n6 b3 |$ C, h; G83: Get Audio Modem Tuning Params
84: Get CNAP Settings
85: Goto Default State
6 }& W* h8 ^' I! _$ P8 g, J86: Gps Mt Fix Response
87: Send Ussd Response
: ?! W8 r. |" }! Z8 b88: Cancel Ussd
89: Get RadioType
90: Get Charger Setting
91: Get Charger Status
92: Set System Time
93: Get Network Mode Selection
. J  h4 e' }- X( r0 |94: Sim Command for GSM only
% l: D3 L. {7 m6 X95: GetNetworkId for GSM only
96: GetNetworkList for GSM only
) p4 a/ d" P0 P# c. K# ]97: SetNetwok for GSM only
# k- \4 E  t$ v+ a98: GetMsInfoString
$ _6 {* W7 s3 [% O, w& s1 l, q99: Exit

Enter a Choice: 52
: g& z, f7 B/ Q
5 R5 k; R; i3 a/ h6 F7 \7 \& j....COMMAND: "resetradio"
* h' k9 I: m# C
SPN Data:  
+ W/ x$ }" i9 @/ d( }( {! ~
! e( b# I' ?  ]% b# L. iEVENT: tel.signalstrengthnotification : RSSI: 6 counter)

- P- y0 o. ^! K) k) REVENT: tel.dataconnectionnotification : CallID: "-3", State: "active", CauseCode: "29"
" G, B' H/ I8 R- @3 }
0 \0 k# o8 E5 REVENT: tel.datastatusnotification : Type: "1xevdo", State: "active"

EVENT: tel.dataregistrationnotification : State: "available", Type: "1xevdo"
3 M5 ?: d9 Q( O% V$ z
EVENT: tel.dataconnectionnotification : CallID: "-3", State: "dormant", CauseCode: "29"
1 x3 L0 o; C* Z7 h# N" R7 ^; `Note the 1xevdo active messages! Congratulations, you have EVDO!

bathy16

一遍下来没看懂,回头再看第二遍

solaris

我的理解是，他从另外一个可以上evdo的手机里面倒出来相关信息，写到pre，就可以了。

我们的问题是插卡，手机里面没有这些信息。

6 H6 {0 W. {, i  M: S: W所以应该不能照搬

atmoftz

好好看看

imbition

A1000000123ABC@hcm.sprintpcs.com
4 P9 z8 \7 y1 S) }3 G  C
不知道这个对应到我们，应该是什么？

blackwhite

原帖由 imbition 于 2009-7-23 18:14 发表
6 v$ H7 M0 C; C. u, [2 O1 VA1000000123ABC@hcm.sprintpcs.com
6 S  q- i+ k/ E; n% E( f5 \
不知道这个对应到我们，应该是什么？

这个应该就是帐户。
9 d: m& p* ]8 y$ _+ g看起来这里提到的破解，和买200刀的破解思路一样，都提到了NV。

my2003sky

都是英文啊，看不懂啊

zxy6350479

看不懂。。。