Free Unlocker for Palm/HP Phones

A few weeks back, I ditched my iPhone for good and got my hands on a used Palm Pre. Unfortunately, it was net-locked by the provider. Fortunately, the modem is Qualcomm device and hence, all security features can be bypassed so easily that they appear meaningless in the first place. I've written unlocking scripts that work on every webOS phone, i.e. Palm Pre (Plus), Palm Pre2, Palm Pixi (Plus), HP Veer, or HP Pre3. You do not need a SIM card for obtaining the unlock code, and the unlock is perfectly safe, i.e. you can't brick your device. Here's a quick how-to:

1. Install python 2.6.x (32 bit/x86 version): http://www.python.org/download/releases/2.6/. Python 3.x will not work.
2. Windows: Install pywin32 for python 2.6: http://sourceforge.net/projects/pywin32/files/
3. Install pyserial: http://sourceforge.net/projects/pyserial/files/
   Linux: Use your packet manager to install the required libraries, e.g. sudo apt-get install python-serial for Debian based distributions (Ubuntu, Mint, etc.) 
4. Download the unlocker (Pre/Pre2/Pixi, or Pre3/Veer) and unpack it (e.g. into the directory C:\unlock)
5. Calculate the USB passthrough key: go to device info, write down the "Serial Number", and use pre_keygen.py to generate the key from this number. The serial number is also printed on the back of your device and/or underneath the battery.
6. Start the phone without a SIM card, then start the dialer. If the phone has not been activated before, you can either select "emergency call" with the icon from the notification area at the bottom (Pre, Pre2, Pixi) and delete the number (911, 112 etc.), or just type "BZ" (#*) blindly on the keyboard (Veer, Pre3). Enter "#*USBPASS# (#*8727277#) in the dialer application and press the dial icon.  A window will appear which asks you to enter the passthrough key. After you've done that, select "Diag" for the "USB PORT 1" (only for that port, the rest has to be set to "None").
   If you have trouble enabling the passthrough mode, bypass the activation, install Preware and install the "Enable USB Passthrough" application from Preware.
7. Windows: Connect your phone to your machine and install these drivers for the serial diagnostics port (not the R-ACM or any other device). The first time you plug in the phone in diagnostics mode, Windows will ask you for drivers. You can also force the driver installation in the device manager by right-clicking the unknown serial port under "Other devices" and selecting "Update drivers". You might have to acknowledge a few warnings about broken driver signatures.
   Linux: Insert the module usbserial module with vendor and product parameters matching the vendor and product ID (lsusb), e.g. sudo modprobe usbserial vendor=0x0830 product=0x8043. You have to make the device file (usually /dev/ttyUSB0) accessible to regular users, or you have to run the unlock script with root privileges.
8. Run pre_unlock.py / pre3_veer_unlock.py and write down your network unlock code.
   If the serial port is not found automatically or if the search is stuck, you can specify it as a command line parameter. Open up a command prompt, navigate to the directory (cd \unlock) and run the unlocker, e.g. pre_unlock.py --diagPort COM5
   If the firmware version has not been recognized, update your device to either the latest webOS 1.4.x or 2.x version. If you don't have a Palm account, you can obtain the updater here.
9. Disable the passthrough mode: enter "#*USBPASS# (#*8727277#) and press the dial icon again. Set "None" for "USB PORT 1".
10. Shutdown the phone. Put in a SIM card that is not accepted by the phone and boot it up again. You might have to bypass the activation mechanism.
11. Carefully enter the network unlock code obtained in step 8. If it gets rejected, please contact me with the perso.txt file that has been saved to the directory of the script. Reboot and enjoy your unlocked phone.
    If and only if the unlock code does not work for you ("Enter Unblock Code"), try running the script with the parameter --writeBack from the command prompt, e.g. pre3_veer_unlock.py --writeBack. After it has completed successfully, reboot your phone and it should be unlocked.
    If you need to activate your phone, but your carrier does not support data services, you can try this.

The script should also work for Linux, MacOS, BSD and any other system which has drivers for the USB diagnostics mode and a python interpreter. I'd like to know whether this worked for you, so please leave a comment. Also, all sources of the unlocker have been released under the terms of the GPL. Feel free to hack away with them.

Dell 2A7B Keygen

A slight modification and the keygen generates now valid passwords for Dell 2A7B serials as well as for the -595B serials.

Source Code & Binaries

Quick How-To:

1. Download the archive of the keygen from the link above. It contains two files: a C file (source code) and an executable. If you are on Windows, just unpack and double-click the executable. If you are on Mac/Linux/BSD, compile the C file:
   gcc -o dell dell.c 
2. You are asked to enter the serial number of your device. Use ONLY CAPITALS for the serial number.
3. Press Enter and you'll get the password. Keep in mind that the passwords are encoded for a QWERTY-type keyboard layout (US-EN). Also, some models require you to press Ctrl+Enter after entering the password.

Update: Here's is an online version.

Fix for the -595B Keygen

Apparently, only some of my readers have been able to derive the fix necessary to generate valid HDD passwords. It's been easily guessable that the prehashing scheme needed some minor modification. Before I get countless requests now, here's the C source code for hpgl's keygen:
http://pastebin.com/cu9ijqM1

You need a C compiler to generate the executable (d'uh), e.g. gcc/mingw32, Visual C, lcc, etc., or you can just use the binaries linked below.

Update: Windows binaries...

Dell -595B Keygen

Before I get spammed with even more emails, here are the C sources for a keygen suitable for -595B and other dells (courtesy of hpgl):
http://pastebin.com/yEsiqyQy

You need a regular C compiler for compiling an executable (e.g. mingw32/gcc).

So now let's sit back and watch the inflation happen...

Update: small fix (Windows binaries) - see this post.


Quick How-To:

1. Download the archive of the keygen from the link above. It contains two files: a C file (source code) and an executable. If you are on Windows, just unpack and double-click the executable. If you are on Mac/Linux/BSD, compile the C file:
   gcc -o dell dell.c
2. You are asked to enter the serial number of your device. Use ONLY CAPITALS for the serial number.
3. Press Enter and you'll get the password. Keep in mind that the passwords are encoded for a QWERTY-type keyboard layout (US-EN). Also, some models require you to press Ctrl+Enter after entering the password.
    

Unlock Code Generator for ZTE Cell Phones

Here's a script which can generate unlock codes for ZTE cell phones:
zte-unlock.py
The script implements an algorithm reverse-engineered by the collaborative effort of elcapitel and y3kt. You need python 2.x to run the script.
Supported Models: GX760, GX761, SFR 232, SFR 341, SFR 342, X760, X761, Orange Vegas, Vodafone Indie, T-Mobile Vairy Touch.

Unlocker for Option GI0225 3G Modems

A couple of months ago, I bought a dirt-cheap 3G modem labeled as 'T-Mobile Web'n'Walk' stick. It's actually a relabeled Option Globetrotter Icon 225 which supports both 3G and CDMA networks. The provider installed an annoying netlock on the device - breaking it was quite tough. Here's a quick how-to for Windows for people who want to free their devices:

1. Install python 2.6.x (32 bit version): http://www.python.org/download/releases/2.6/   
2. Install pywin32 for python 2.6: http://sourceforge.net/projects/pywin32/files/
3. Install pyserial: http://sourceforge.net/projects/pyserial/files/
4. Download the unlocker (http://sites.google.com/site/dogber1/blag/msm-unlock-v1.6.zip) and unpack it (e.g. into the directory C:\msm)
5. Download a firmware update for the 3G modem from Option or T-Mobile
6. Unpack the firmware update into the directory used above (e.g. C:\msm)
7. IMPORTANT: The superfire.exe file of the update is packed. Unpack the Superfire.exe file of the firmware update once again (e.g. WinRAR can do that). For the newest update, the superfire.exe can be used as it is.
8. Remove the SIM card from the modem and plug it in . Make sure that you have the latest drivers from the option website installed before you start msm_unlock.py. Also, close all the tools for the stick ('connection manager' etc.). 
9. Write down the unlock code. Unplug the stick, replug it and apply the unlock code with msm_apply.py. If the unlock code is not accepted, search the comments for a posting by "muxx" - he has given detailed instructions on how to manually enter the unlock code.
10. Unplug and replug the stick once more and you've got yourself an unlocked 3G modem. 

The script should also work for Linux, MacOS, BSD and any other system which has drivers for the modem and a python interpreter. Also, it might work for other devices from Option. I'd like to know whether this worked for you, so please leave a comment. Also, all sources of the unlocker have been released under the terms of the GPL. Feel free to hack away with them.

Unlocking LG Phones with the EGold chipset

Recently I bought a dirt-cheap LG phone which had a netlock. After some poking around, I've stumbled across its firmware which I was able to disassemble, so I've written a small script that reads out the netlock code required for unlocking the phone. The phone is interfaced via RS232 which operates at TTL levels: a max232, pl2303 or an equivalent chip should do the job. There are usually soldering points for RXD, TXD and GND on the logic board. Most phones also have pins with these signals at their connector.

The script can save the contents of the flashrom and the so-called "eeprom" (which is just a section of the flashrom containing all the juicy bits) to a file. I've tested it on an LG GB102 and a LG KP100 - it should also work for most other Egold Lite based phones, possibly even from other vendors.
The script has been released under GPL - I wonder how many idiots will ignore this. Anyway, here it is:
lg-unlock.py 
As always, it's a python script that operates on the command line interface. For unlocking your phone, do the following things:

1. Connect TxD, RxD and GND from your serial port interface to the serial port of your cell phone. Keep in mind that you need TTL levels, so you must not use the regular RS232 port of your PC! On your cell phone, there are usually test points where the cable can be directly soldered onto. The battery still has to fit onto the device once your cable has been soldered on. Also, the total length of the cables between the convert chip and the cell phone has to be as short as possible! Alternatively, you can just use a flasher cable (KE500 type for the GB102, KG800 for the KP100).
2. Install Python 2.6.x, then pywin32, and then pyserial.
3. Copy the script to a folder on your hard drive.  
4. Two additional files are required: boot-1st-stage.bin and boot-2nd-stage.bin. I can't distribute them for obvious legal reasons, so you have to find them elsewhere. The sha1 sum of both files is checked during the initialization of the script.
5. Open a command shell and navigate to that folder.
6. Start the script with the parameter specifying the port of your serial interface, e.g. lg-unlock.py --port COM4 -e
7. Press the 'ON' button of your cell phone. You'll receive the unlock code and instructions how to use it from the script.