Essential Tools for changing CDMA carrier on the Pre

寂夜清风

这种方式操作上的可行性还没有测试..
2 G) m( F3 k* j% i. ~需要配合使用的软件还有
0 i7 ~: I% [6 `7 F$ g0 bQPST_2.7_build_323
QXDM31136
( l% E3 [! s) J2 v+ kcdma_workshop
7 w2 l) I* S: ^8 e) ~
Qualcomm QPST tools (Can change NV items and such)
QXDM = Diagnostic Monitoring Tool that can allow you to hex edit items
1 p) K8 ~1 A; [; N3 Z9 xCDMA-workshop = Think of it as a hybrid of qxdm and QPST (This cracked version may show up as a trojan on your AV software)
* F/ n% z8 ?5 Z6 _) d
Tilipctest = a tool that allows you to change your modem and CDMA settings on the phone
PmModemFactory = a tool that allows you to edit and read NV/memory locations on your phone. (this tool can be used to retrieve SPC/MSL)

For these 2 programs you will need to drop them in the /usr/bin folder of your pre
6 [8 Z" S; M& Qthen as root

1. chmod +x /usr/bin/Tilipctest
   
2. chmod +x /usr/bin/PmModemFactory
   - c! g9 g; a# _4 O, N
3. 
   

复制代码

Here are some NV item locations and what is stored in them These are proprietary NV locations for the Palm Pre
Cant read hex? Here is a link for an awesome conversion tool http://home2.paulschou.net/tools/xlate/

1. 09000 = 02 (I believe this specifies the carrier pri, 02 = sprint and 01 = VZW)
   
2. 09006 = Sprint Provisioning #777 (this is what it says)
   % y) f5 ~# i$ _6 N# d3 V: ~. k" H2 ^
3. 09007 = 0 127 0 0 127 0 255 (decimal data)
   1 g5 F' \. f- K7 k# `6 {9 z
4. 09011 = 911 stuff
   
5. 09012 = 6/21/2009 (possible build date?)
   & \" g2 _. T6 I* }1 }2 d) M$ T5 d7 X
6. 09014 = 113 2 0 0 29 1 (?????? HomeNID/SID data??)
   
7. 09021 = http://mms.vtext.com/servlets/mms (i changed this one already to test, i dont remember the original sprint MMS value)
   * b* A% V$ s. v! A, s* U
8. 09023 = http://pictures.sprintpcs.com/WMTP_3_4
   
9. 09025xx = 1 31 28 68 80 (port then IP for primary gateway, in reverse)
   % r0 o$ p  v2 N5 V2 Q6 g
10. 09030 = 160 (decimal value, no idea wtf it is)
    
11. 09047 = Sprint (banner)
    4 |# I, J( i3 V% M- ]& _
12. 09055xx = 20 31 28 68 (decimal, IP or something, in reverse)
    
13. 09057 = http://mcd.sprintpcs.com/redirect?request=multimedia
    
14. 09076 = http://vision.sprintpcs.com
    , D, {; d# s9 e  L: p
15. 09077 = http://vm.sprintpcs.com/redirect
    
16. 09079 = http://.sprintpcs.com
    : v- I% A; p6 f4 D, K. b
17. 09104 = @hcm.sprintpcs.com
    # w* u, C/ [' V7 y, ?
18. 09105 = MYpESN@hcm.sprintpcs.com AND @hcm.sprintp
    + o( ?3 H& i  W: W2 z
19. 09108 = @hcm.sprintpcs.com AND @hcm.sprintpcs.com
    0 J4 ]% i6 O- T: F# n
20. 09109 = @hcm.sprintpcs.com AND @hcm.sprintpcs.com
    
21. 09110 = MYpESN@hcm.sprintpcs.com (LENGTH MARKER HERE)
    
22. 09111 = 16 16 13 12 255 255 255 255
    - y% [+ ~  {. F% d; o
23. 09152xx = 33 31 28 68 80 80 (IP port in reverse, proxy NGG?)
    
24. 09153xx = 33 31 28 68 80 80 (IP port in reverse, proxy NGG?)

复制代码

http://www.c4pda.com/showthread.php?t=68179