解锁HTC TOUCH SPRINT, +GPS

感谢Fitwxc及其他大侠.
Sprint, Alltel, MetroPC
HTC Dianond, Touch, Touch Pro
估计都行，　没有evdo只是1x, ONLINE-GPS
基本任务如下:

1．用getspc找到MSL,
2. 把SPRINT公司的MSL改成VERIZON公司用的六个零“000000”。 这个过程需要借助工具,用QPST修改为000000
3. 下载VERIZON的PRL----51600, dcd Verizon Carrier 20090831.cab
4. 更新prl,run dcd Verizon Carrier 20090831.cab
到了这一步，就可以给fitwxc大侠发QQH，告诉他MEID号，请他帮着开通PP了或转机.
*22801 为 verizon program. *228 还是sprint 多试试.
5. 此时有call 和 text,
6. unlock－dmu---evdo---gps 见下:
７　有两种方法,　大同小已,还有http://web.wenxuecity.com/BBSView.php?SubID=computer_best&MsgID=1888　（HTC6850）

you will need
QPST (google this)
GetSPC.exe or Baffles MSL Grabber (you can find it here: http://www.baf.cc/bafmsl you will need .net framework 3.5 installed on your phone)
An unlocked Sprint Touch Pro (Raphael Unlocker here http://forum.ppcgeeks.com/showthread.php?t=42503)
VZW leaked rom (that you can find here : ftp://ppcgeeks.com/Raphael/Stock%20R...51064_Ship.exe)
The most current vzw PRL (Again you can find that here : http://www.corolada.com/prl/verizon/51056.prl)　51600
DMU Keys (Find that here : http://forum.ppcgeeks.com/attachment...2&d=1205773368)


Step One
You can perform this step on your phone. Install Baffles MSL Grabber and write your MSL. My suggestion is to open up a text document and type it there because it will be necessary later on.

Step Two
Unlock your device using the Raphael team elite unlocker for sprint. I used the second link (I believe .37).

Step Three
Install the htc modem drivers on your computer (that's kind of important)

Step Four
Install QPST on your computer

Step Five
If you completed all the preliminary steps, you should be ready to fully begin. At this point, you can perform the steps on the vzw leaked rom or on your sprint touch pro rom. If you are performing this on the sprint touch pro rom, you will need DCD carriers cab. On the vzw rom, however, I have noted that MMS does work on the phone (and you know how much we love our mms). I think this is solely up to you whether or not you use either rom for operation. Remember though, if you are doing this on a sprint rom

DMR mode for sprint is
##3424#

Whereas DMR for vzw is
##3424 and press the send key (send key is below the home hardware button - you can also use the send key on the phone)

Also EPST for sprint is
##778#

whereas this for a vzw phone is

##778 and hit the send key

So how you will work is solely up to you

What you would need to do next is place your phone in DMR mode. Connect your phone to your computer via u***** mode. If everything worked okay, the popup for drivers shouldn't come up at all. Start QPST config and select ports

Step Six
Now, in QPST, your phone should come up. If it doesn't, right click on my computer and select properties. Click hardware and then device manager. Click view and device by connection. Click on your USB controllers and don't stop until you see HTC. Notice the com port that the HTC device is on (mine on two different computers, running xp or vista was COM5, yours may be different). Take a note of this and return to QPST config. Now, click add COM port, and add the port you saw in the device manager. QPST will pick up the phone.

Step Seven
Now, click on services and go to services programming. Select your phone and begin. This will ask for your MSL. Type it in and continue. Click read from phone. You may have to retype that MSL code, if not good. but on some cases, it asked me for my MSL code twice (unfortunately) so I typed it in twice. The point of it all is this - to get the data from your phone to QPST

Step Eight - changing your MSL
Now that you are in QPST Service programming, you can change your MSL unlock code. Please change it to 000000. That is vzw's MSL code, and it is so easy to remember for later on. Once this is done, click write to phone. I caution, do not close out of QPST service programming until this is done! You will know when this is done if you can see that the buttons read from phone, write to phone, are not grayed out.

Step Nine (optional)
Okay so at this point, I installed the leaked vzw rom but it is not necessary to perform this step at all. Its just something I did to make things a lot easier on me. Individual results can vary though.

Step Ten
Now, its time to change our MIP settings. Go into EPST and select your MIP profile. On your phone you can edit the information to match the following:

MIP Profile
Number of profiles: 6
Active user profile index: 0
MIP_MODE: Mobile IP Prefered
MIP Reg Retries: 2
MIP Reg Retry: 1750 ms
MIP Pre-Reg Timeout: 0
Mobile Node-HA: Enable
Send A Reg: Disable
Dormant Handoff Opt: Enable

Step Eleven
Now in EPST, go to MIP default profile and edit the information on your phone to match these settings:

MIP Default Profile
Enable Profile: Enable
NAI: [e-mail] ([e-mail])
DUN NAI: (if entry is there enter [e-mail] so you can tether without a tethering package or [e-mail] if you want paid tethering))
MN HA SPI Set: Enable
MN HA SPI Value: 12C
MN AAA SPI Set: Enable
MN AAA SPI Value: 0 (requires a "2" here for 6800 and 6900)
Reverse Tunneling: Enable
Home Address: 0.0.0.0
HA Shared Secret: (erase whatever entry is here leave blank)
AAA Shared Secret: (erase whatever entry is here leave blank)
Primary HA Address: 255.255.255.255
Secondary HA Address: 255.255.255.255
DMU Pub Key: 10
MN Authenticator: 0

It is very important to erase the HA and AAA shared keys. We will return back to them momentarily

Step Eleven
Complete changes from EPST and the device will soft reset. Now place your phone in diag mode. Connect your phone to your computer and enter QPST EFS explorer. Unzip the DMU keys and notice you will see the file on your hard drive. In EFS explorer, you will see the DMU folder. Right click on the folder and you will be able to insert a DMU key via the file explorer on your computer. Select the DMU key file and press okay. The information will be written to the phone.

Step Twelve
Drag your PRL file you downloaded from your computer to your cell phone memory. Dial ##PRL and hit send if you are on vzw rom, if not ##PRL# if you are still on the sprint rom. This will lead to a dialog box on your phone that will allow you to locate the PRL file you loaded onto your phone. Make sure the PRL is in a directory where you can access it when you browse for it on your phone.

Step Thirteen
Place your phone back in diag mode. Connect to QPST service programming and go to the MIP default profile (AAA shared secret and HA shared secret is where you need to go in Service programming). If there is anything in those two areas, delete it, click enter hex values and leave it blank. Write to phone.

Step Fourteen
If you are still on a sprint phone, install DCD vzw carrier cab. If not, please dial *228. The menu has changed, so you will have to hear EVERY option before selecting. You will enter option number 3. Go through the prompts on vzw's end and the phone will program and soft reset.

Step Fifteen
Once your phone has soft reset, you're almost done! You should have text messaging and voice, but data not yet. So to get data, you have some options. If you can't get data to authenticate, follow step thirteen. Then force the phone into 1x mode (I don't care how you do it - what I did was go to a mall basement) and connect to the internet in 1x mode. EvDO won't work, but 1x does work. What is going to happen is the HA and AAA shared keys will be written. If all goes well, you should have your sprint touch pro phone 99.9% working on vzw network.
1) check your esn is it higher than 05401114111 call customer service at 800-922-0204 and ask them to check if it can be activated also ask them to check it in the DMD esn database. If lower read below (6700 only this is just a rough esn range. 6800 and 6900's from other carriers 100% of the time have to be added in)
http://forum.smartphonejunkie.com/f498/sprint-touch-pro-vzw-network-tutorial-177433/


Verizon does have a lower esn range if the 6700's esn falls below 05401114111 it is not in verizons esn database. Tech support will have to manually add it which is rather difficult to do. It requires persistence and catching the right knowledgeable tech in the right mood pretty much. There is a way for auth agents to force a foreign esn in using a glitch in the system (THIS LOOPHOLE WAS CLOSED IN THE 8/10 EROES PATCH)but this can only be done on a brand new activation (cannot do on esn swaps) but if you ever change phones the phone will have to be added into the esn database by a tech to use it again. However, the latter method would give you a pretty valid arguement to get it added in as they can see that you were using that esn prior on the network and tell them it was changed in error. **Always say you have an alltel phone for greatest chance of success**

***Update*** For those having trouble getting an esn loaded read this post. Please do not pm me asking for help getting your esn added as I have been bombarded with requests use form here if calls to tech support are unsuccessful http://forum.ppcgeeks.com/showthread.php?t=24855

2) Break that spc code. If you have altell disregard as their spc code is 000000 along with vzw.

Put your phone in dm mode its ##diag talk or ##diag# talk on most phones (carrier dependant search the boards here). Press start (left soft key) and plug in u***** cord to both phone and pc if you have vista the drivers will auto install. If you have xp you will need to download the diagnostics drivers attached in this post and manually direct the install to where they were downloaded in your pc.

Place your diagnostic port for the phone on com 2 and run the se47 program it will set the spc to all 0's in less than 2 seconds. Press stop and disconnect phone from u*****.
*edit se47 will only work on a 6700 not 6800 or 6900 use getspc and qpst to set spc to all 0's
Method here for non sprint 6800's and 6900's that getspc won't work with http://forum.ppcgeeks.com/showpost.p...&postcount=126

3) *6700 only* supercid phone's bootloader so any carriers rom will take (not necessary if using no id ruu and helmi's wm6.1 with a bootloader 1.00, 1.02, or 2.02 or with the stock no bootloader rom linked in step 4 **6800 & 6900 supercid method http://forum.ppcgeeks.com/showthread...light=supercid this is not needed just for info only as you can just use the olipro or imcokeman unlockers**

You will need bitpim (free program http://bitpim.sourceforge.net/ ) and qpst (dont ask for a link. Hint join mobilefiles.com)

Place the phone in dm mode again ##diag talk or your carriers version of it. Load bitpim and select other cdma phone on port 2 and save the nvm_htc file to desktop. Load xvi32 (hex editor) and change the carrier wording ie. VZW__001 or your carrier's wording (will be 8 spaces) to "11111111" (without quotes) and save file. Use qpst and overwrite the nvm_htc with the supercid nvm_htc file.

4) Create a custom rom using helmi's6.1 search here and read up and make sure to pick verizon in carrier spots (assuming phone is superCID unlocked w/ bootloader 1.04, 2.04 & 2.05 or using NoId RUU with bootloader 2.02, 1.00, & 1.02). If you would like a stock vzw WM5 rom this is a link here to one here that will not change your bootloader version and will work on all bootloaders http://forum.ppcgeeks.com/showthread..._aku3_official

Flash rom I recommend using radio 1.43 on verizon so if you go with a helmi 6.1 search for that radio version or pull it from the stock rom link above.

5) Upload prl via ##prl and load off memory card or use active sync to add it to my docs then do ##prl to load it. After prl load dial a *228 option 1 after the esn change has been done on your account. Do a ##eri to update eri the same way as prl update from memory card or active sync on phone then load it off of phone from ##eri. PRL & ERI are attached to bottom of post. FYI the ERI will not load on most phones it has loaded about 10% of the time for me on 6700's all midwest wireless and 1 of 4 Qwest ones and never on a 6800 or 6900.


5) edit data settings to vzw dial ##778 and enter your new msl of 000000

MIP Profile
Number of profiles: 6
Active user profile index: 0
MIP_MODE: Mobile IP Prefered
MIP Reg Retries: 2
MIP Reg Retry: 1750 ms
MIP Pre-Reg Timeout: 0
Mobile Node-HA: Enable
Send A Reg: Disable
Dormant Handoff Opt: Enable

MIP Default Profile
Enable Profile: Enable
NAI: [e-mail] ([e-mail])
DUN NAI: (if entry is there enter [e-mail] so you can tether without a tethering package or [e-mail] if you want paid tethering))
MN HA SPI Set: Enable
MN HA SPI Value: 12C
MN AAA SPI Set: Enable
MN AAA SPI Value: 0 (requires a "2" here for 6800 and 6900)
Reverse Tunneling: Enable
Home Address: 0.0.0.0
HA Shared Secret: (erase whatever entry is here leave blank)
AAA Shared Secret: (erase whatever entry is here leave blank)
Primary HA Address: 255.255.255.255
Secondary HA Address: 255.255.255.255
DMU Pub Key: 10
MN Authenticator: 0

6) Upload a dmu key

Put phone in dm mode ##diag talk and load bitpim or qpst and load a vzw dmu key into the dmu folder on the phone. **UPDATE** added a public dmu key a few post down (post #4) so u guys that don't have any existing vzw phones can get on the network.** Some 6800's you can only do this with qpst. Highlight the dmu folder and right click and pick add new file and browse to where you saved the 10.key on your pc then load it via qpst or bitpim to phone.

7) when you attempt a internet connection it will write your shared secret keys and if you followed this correctly data should be working. This is only for a non- VZW phone that has never been in use on VZW with working data. If it has it already has the vzw dmu key it needs a dmu reset if data fails assuming the connection profile is correct and data is active on the account.

THESE DATA SETTINGS WILL WORK ON OTHER CARRIERS 6800's and 6900's IF YOU CAN GET A TECH TO LOAD THE ESN OR WAIT FOR OPEN NETWORK LATER ON THIS YEAR. YOU STILL HAVE TO LOAD A VZW DMU KEY AS WELL. Open network will provide no tech support beyond voice and sms for non-native vzw phones. I have switched several sprint 6800's and 6900's over this method works perfectly with full data just use the correct unlockers and roms.
http://forum.ppcgeeks.com/showthread.php?t=20090

I got my Sprint Touch Pro added on Verizon without any tech support!!!!

First obtain the MSL code for the Sprint Touch Pro (Search the forums for many ways to do this). Change your MSL to 000000 using QPST (Again, search is your friend here. Copy all the EPST settings from a Verizon Pocket PC, such as an XV6800 (type ##EPST on the dialer of the Verizon Pocket PC Phone) from the EPST menu into the Sprint Touch Pro. You can also go to one of the links below if you don't have another Verizon Pocket PC Phone.

You then download the newest Verizon PRL available from http://www.corolada.com/prl/ and update the PRL on the Sprint Touch Pro by typing ##PRL# on the dialer and finding the new Verizon PRL you downloaded. You can also try updating your ERI by downloading the Verizon ERI but I couldn't get this to work, it's not necessary though.

To get Data to work you need the Verizon Public DMU Key. Use QPST to add this to the Sprint Touch Pro Phone. This can be found on one of the below links.

You then need to run DCD's Verizon Carrier Customizations. You never have to unlock your phone or change ROMs, this can all be done on the Sprint Stock ROM!!! Use the following links for reference:
http://forum.ppcgeeks.com/showthread...tivate+verizon
http://forum.ppcgeeks.com/showthread.php?t=39985

Finally, all you need to do is dial *228 on the Sprint Touch Pro and choose the option to add a new device. You enter in your info and presto, the device activates on the Verizon network and you never even have to talk to anybody or beg them to add your ESN or MSID!!!! I was totally shocked that this worked but it did!!


*********************Enable/Disable EVDO (Force 1X or EV-DO)********************************
I don't know why they hide this option, but for people living on fringe areas as I do, it is nice to be able to force 1X or EV-DO on or off.
To do so:
1) Obtain a registry editor (I just use total commander)
2) Navigate to \registryHKLMSOFTWAREOEMPhoneSetting
3) Change the value of 'HiddenModeOperationPage' from 1 to 0
4) Save
5) Soft reset
It didn't seem to want to remember the value of 0 for me the first couple times, and I'm not sure why.
What this does:
-Adds an item to the list at 'Phone - Menu - Options - Services (Tab on bottom)' that is named "Mode of Operation". The default value of this is Hybrid, which will prefer EVDO, but will use 1X when not available. I seem to get better reception at home if I change the option to 1X Only.
As a side note, there are a couple other 'Hidden...' pages in this registry directory that I don't have time to play with right now. Maybe someone else will figure out what they do.
http://pdaphonehome.com/forums/ppc-6800-xv6800/88957-enable-disable-evdo-force-1x-ev-do.html

****************************QPST*******************************GPS**********************8


After clicking SERVICE PROGRAMMING, the Phone Selection box should pop up. Select _SURF7500_ in the box, then click OK. It should look like this before clicking OK.
Your phone should now be connected to SERVICE PROGRAMMING. On the bottom left of the window, click Read from Phone.
Make sure 000000 is filled in for the service programming code, and click OK. This will read all the current values programmed. When it finishes, it should now look something like this.
IMPORTANT!!!
Before you proceed any further, make a backup of your phone's current programming by clicking Save to File_ in the bottom right corner.
Keep the default filename, choose a location, then click _Save.
Once you've made your backup, navigate to the _gpsOne_ tab by clicking the right arrow located in the top right of the window.
Once you've clicked on the _gpsOne_ tab, the nine check boxes on the left of the window should be checked if they're not already. (Fig. 7)
Next, you need to fill in the following Verizon aGPS PDE information:
PDE IP Address: 216.198.139.92
PDE Port Number: 8889
PDE Transport: IP
Position Calculation: PDE
Next, you need to write the new programming to the phone by clicking _Write to Phone_ on the bottom left of the window.
Once it completes, close the window being careful NOT to save changes (as it will overwrite the backup you made earlier). You can now close the rest of the QPST windows that are open.
Take your phone out of DMR Mode by dialing ##3424 and send to bring up DMR on your phone again. Click _Exit_ on the bottom left corner of your phone's screen.
Perform a soft reset.
When the phone reboots, install _Serf Telus aGPS.cab_ (found at the top of this tutorial) and soft reset again.
Navigate to Start -> Settings, and click on _Phone_ in the _Personal_ tab. Click on the _Services_ tab at the bottom. Highlight _Location Setting_ and click Get Settings. Ensure that _LOCATION ON_ is selected. (Fig. 9)
Navigate to Start -> Settings, and click on _External GPS_ in the _System_ tab. Ensure that _GPS program port_ is set to _COM4_ in the _Programs_ tab (Fig. 10),
GPS hardware port_ is set to _(None)_ and _Baud rate_ is set to _4800_ in the _Hardware_ tab (Fig. 11),
and _Manage GPS automatically (recommended)_ is checked in the _Access_ tab (Fig. 12).
Congratulations, you now have working aGPS on Verizon Wireless custom ROMS with all 3rd party applications.
http://wiki.xda-developers.com/index.php?pagename=VerizonAGPSFix

所有跟帖： 

• PAGEPLUS PRL and all other links -WXC0210- ♂ (292 bytes) () 02/18/2010 postreply 13:28:06

• 大顶,难得的宝典 -小放- ♂ (0 bytes) () 02/18/2010 postreply 17:32:20

• 谢谢分享，辛苦了 -kzch- ♂ (0 bytes) () 02/19/2010 postreply 07:47:03

• I tried all this on my touch pro 2. data still not working. -leifeng- ♀ (156 bytes) () 02/19/2010 postreply 09:04:21

• using pageplus prl? also:NAI: [e-mail] password:vzw -wxc0210- ♂ (680 bytes) () 02/19/2010 postreply 15:07:03

• Thank you so much! Very helpful! -一亩三分田- ♂ (0 bytes) () 02/19/2010 postreply 14:37:56

• 请问htc xv6800/mogul/titan适用吗？ -中北- ♂ (0 bytes) () 02/21/2010 postreply 06:31:25

• 适用 -wxc0210- ♂ (0 bytes) () 02/23/2010 postreply 12:01:44