Free Unlocker for Palm/HP Phones

A few weeks back, I ditched my iPhone for good and got my hands on a used Palm Pre. Unfortunately, it was net-locked by the provider. Fortunately, the modem is Qualcomm device and hence, all security features can be bypassed so easily that they appear meaningless in the first place. I've written unlocking scripts that work on every webOS phone, i.e. Palm Pre (Plus), Palm Pre2, Palm Pixi (Plus), HP Veer, or HP Pre3. You do not need a SIM card for obtaining the unlock code, and the unlock is perfectly safe, i.e. you can't brick your device. Here's a quick how-to:

1. Install python 2.6.x (32 bit/x86 version): http://www.python.org/download/releases/2.6/. Python 3.x will not work.
2. Windows: Install pywin32 for python 2.6: http://sourceforge.net/projects/pywin32/files/
3. Install pyserial: http://sourceforge.net/projects/pyserial/files/
   Linux: Use your packet manager to install the required libraries, e.g. sudo apt-get install python-serial for Debian based distributions (Ubuntu, Mint, etc.) 
4. Download the unlocker (Pre/Pre2/Pixi, or Pre3/Veer) and unpack it (e.g. into the directory C:\unlock)
5. Calculate the USB passthrough key: go to device info, write down the "Serial Number", and use pre_keygen.py to generate the key from this number. The serial number is also printed on the back of your device and/or underneath the battery.
6. Start the phone without a SIM card, then start the dialer. If the phone has not been activated before, you can either select "emergency call" with the icon from the notification area at the bottom (Pre, Pre2, Pixi) and delete the number (911, 112 etc.), or just type "BZ" (#*) blindly on the keyboard (Veer, Pre3). Enter "#*USBPASS# (#*8727277#) in the dialer application and press the dial icon.  A window will appear which asks you to enter the passthrough key. After you've done that, select "Diag" for the "USB PORT 1" (only for that port, the rest has to be set to "None").
   If you have trouble enabling the passthrough mode, bypass the activation, install Preware and install the "Enable USB Passthrough" application from Preware.
7. Windows: Connect your phone to your machine and install these drivers for the serial diagnostics port (not the R-ACM or any other device). The first time you plug in the phone in diagnostics mode, Windows will ask you for drivers. You can also force the driver installation in the device manager by right-clicking the unknown serial port under "Other devices" and selecting "Update drivers". You might have to acknowledge a few warnings about broken driver signatures.
   Linux: Insert the module usbserial module with vendor and product parameters matching the vendor and product ID (lsusb), e.g. sudo modprobe usbserial vendor=0x0830 product=0x8043. You have to make the device file (usually /dev/ttyUSB0) accessible to regular users, or you have to run the unlock script with root privileges.
8. Run pre_unlock.py / pre3_veer_unlock.py and write down your network unlock code.
   If the serial port is not found automatically or if the search is stuck, you can specify it as a command line parameter. Open up a command prompt, navigate to the directory (cd \unlock) and run the unlocker, e.g. pre_unlock.py --diagPort COM5
   If the firmware version has not been recognized, update your device to either the latest webOS 1.4.x or 2.x version. If you don't have a Palm account, you can obtain the updater here.
9. Disable the passthrough mode: enter "#*USBPASS# (#*8727277#) and press the dial icon again. Set "None" for "USB PORT 1".
10. Shutdown the phone. Put in a SIM card that is not accepted by the phone and boot it up again. You might have to bypass the activation mechanism.
11. Carefully enter the network unlock code obtained in step 8. If it gets rejected, please contact me with the perso.txt file that has been saved to the directory of the script. Reboot and enjoy your unlocked phone.
    If and only if the unlock code does not work for you ("Enter Unblock Code"), try running the script with the parameter --writeBack from the command prompt, e.g. pre3_veer_unlock.py --writeBack. After it has completed successfully, reboot your phone and it should be unlocked.
    If you need to activate your phone, but your carrier does not support data services, you can try this.

The script should also work for Linux, MacOS, BSD and any other system which has drivers for the USB diagnostics mode and a python interpreter. I'd like to know whether this worked for you, so please leave a comment. Also, all sources of the unlocker have been released under the terms of the GPL. Feel free to hack away with them.

Another One Bites the Dust: HP/Compaq Mini Netbooks

That was suprisingly easy:

As always, the script (Windows binary) is released under the binding terms of the GPL - let's sit back and watch the decline of eBay prices and the sudden appearance of my code in the tools of the GSM idiots.

Update: I got a couple of emails from folks for which the generated passwords didn't seem to work. It turned out that they confused the number "l" for the letter "1" and vice versa. If you find that it doesn't work for you, copy and paste the generated password from the script into an editor which has a legible typeface.

BIOS Password Backdoors in Laptops

Synopsis: The mechanics of BIOS password locks present in current generation laptops are briefly outlined. Trivial mechanisms have been put in place by most vendors to bypass such passwords, rendering the protection void. A set of master password generators and hands-on instructions are given to disable BIOS passwords.

When a laptop is locked with password, a checksum of that password is stored to a so-called FlashROM - this is a chip on the mainboard of the device which also contains the BIOS code and other settings, e.g. memory timings.

For most brands, this checksum is displayed after entering an invalid password for the third time:

The dramatic 'System Disabled' message is just scare tactics: when you remove all power from the laptop and reboot it, it will work just as before. From such a checksum (also called "hash"), valid passwords can be found by means of brute-forcing.

The bypass mechanisms of other vendors work by showing a number to the user from which a master password can be derived. This password is usually a sequence of numbers generated randomly.

Some vendors resort to storing the password in plain text onto the FlashROM, and instead of printing out just a checksum, an encrypted version of the password is shown.

Other vendors just derive the master password from the serial number. Either way, my scripts can be used to get valid passwords.

A few vendors have implemented obfuscation measures to hide the hash from the end user - for instance, some FSI laptops require you to enter three special passwords for the hash to show up (e.g. "3hqgo3 jqw534 0qww294e", "enable master password" shifted one up/left on the keyboard). Some HP/Compaq laptops only show the hash if the F2 or F12 key has been pressed prior to entering an invalid password for the last time.

Depending on the "format" of the number code/hash (e.g. whether only numbers or both numbers and letters are used, whether it contains dashes, etc.), you need to choose the right script - it is mostly just a matter of trying all of them and finding the one that fits your laptop. It does not matter on what machine the script are executed, i.e. there is no reason to run them on the locked laptop.
This is an overview of the algorithms that I looked at so far:

Vendor	Hash Encoding	Example of Hash Code/Serial	Scripts
Asus	Machine Date	01-01-2011	pwgen-asus.py
Compaq	5 decimal digits	12345	pwgen-5dec.py Windows binary
Dell	serial number	1234567-595B 1234567-D35B 1234567-2A7B	bios-pw.org
Fujitsu-Siemens	5 decimal digits	12345	pwgen-5dec.py Windows binary
Fujitsu-Siemens	8 hexadecimal digits	DEADBEEF	pwgen-fsi-hex.py Windows binary
Fujitsu-Siemens	5x4 hexadecimal digits	AAAA-BBBB-CCCC-DEAD-BEEF	pwgen-fsi-hex.py Windows binary
Fujitsu-Siemens	5x4 decimal digits	1234-4321-1234-4321-1234	pwgen-fsi-5x4dec.py Windows binary
Fujitsu-Siemens	6x4 decimal digits	8F16-1234-4321-1234-4321-1234	pwgen-fsi-6x4dec.py
Hewlett-Packard	5 decimal digits	12345	pwgen-5dec.py Windows binary
Hewlett-Packard/Compaq Netbooks	10 characters	CNU1234ABC	pwgen-hpmini.py Windows binary
Insyde H20 (generic)	8 decimal digits	03133610	pwgen-insyde.py Windows binary
Phoenix (generic)	5 decimal digits	12345	pwgen-5dec.py Windows binary
Sony	4x4 hexadecimal digits	1234-1234-1234-1234	pwgen-sony-4x4.py
Sony	7 digit serial number	1234567	pwgen-sony-serial.py Windows binary
Samsung	12 hexadecimal digits	07088120410C0000	pwgen-samsung.py Windows binary

Here are some other folks' efforts (python/ocaml/javascript):

Vendor	Hash Encoding	Example of Hash Code/Serial	Scripts
HP	8 decimal digits	i1234578	https://gist.github.com/Rdp3389
Acer/Insyde	10 decimal digits	123457890	https://github.com/let-def/insydious

The .NET runtime libraries are required for running the Windows binary files (extension .exe). If the binary files (.exe) don't work out for you, install Python 2.7 (not 3.x) and run the .py script directly by double-clicking them. Make sure that you correctly read each letter (e.g. number '1' vs letter 'l').

Вячеслав Бачериков has also converted my scripts to javascript so you can calculate the passwords with your browser: http://bios-pw.org/ (sources).

Please leave a comment below on what make/model the scripts work. Also, be aware that some vendors use different schemes for master passwords that require hardware to be reset - among them are e.g. IBM/Lenovo. If you find that your laptop does not display a hash or the scripts do not work for you for whatever reason, try to:

• use a USB keyboard for entering the password for avoiding potential defects of the built-in keyboard,
• run CmosPwd to remove the password if you can still boot the machine,
• overwrite the BIOS using the emergency recovery procedures. Usually, the emergency flash code is activated by pressing a certain key combination while powering on the machine. You also need a specially prepared USB memory stick containing the BIOS binary. The details are very much dependent on your particular model. Also, be aware that this can potentially brick your device and should only be done as a last measure.
• Some dell service tags are missing the suffix - just try the passwords for all suffices by adding -595B, -2A7B and -D35B to your service tags. 
• The passwords for some HP laptops are breakable with this script.
• Unlocking methods for some Toshiba laptops are described here (edit: gone). 
• Some older laptop models have service manuals that specify a location of a jumper / solder bridge that can be set for removing the password.

If none of the generators/methods above works, please use the vendor support. Please understand that my motivation for reverse-engineering comes purely from a personal interest. I will not accept offers to look at the specifics of certain models.