Monday, February 23, 2009

Getting your sprint phone on a vzw network

This post is taken from a PPCGeeks Thread :
Verizon - Sprint Touch Pro on VZW Network Tutorial

I am going to attempt this in a day or so...I have read thru the entire thread (all 93 pages) and recorded some of the solutions to problems people had. I will augment these steps and maybe explode them out a bit and add some pictures as I myself go thru the process.

You will see my comments and changes in this color. The original post in this color. I've modified the content a bit of the original post to make it easier to follow...for me at least.

First, you need to understand that these phones have two different parts...the ROM and the Radio. The Radio is programmed to talk to the towers for each carrier. The ROM is the operating system of the phone.

Next, you will need to know some terms:
ROM: I'm not sure what the acronym stands for. But in the Windows Mobile world...this is basically the operating system of the phone. The ROM also has some specific configuration settings that make the operating system and other programs work the Radio part of the phone.
QPST: from widipedia : (Qualcomm Product Support Tool) It features a file explorer, factory test tools, low level communication settings, RF calibration tools, roaming list editor, service programming tool, and more.
MSL : (Master Subsidiary Lock ) : Your carrier's way of keeping you on their network. it's the lock on the Radio ( I think)
PRL : (Preferred Roaming List) :
Unlocker : This is different then the MSL. The Unlocker basically removes the lock on the ROM
DMU Keys: (Dynamic Mobile Update Keys): DMU is a mechanism for distributing and updating Mobile IP (MIP) cryptographic keys in CDMA2000 1xRTT (1X) and 1xEV-DO (EV-DO) networks. This new process protects data as a user moves from one cellular coverage area to another.



you will need
It's very important to use build 301. there have been many reported problems with earlier builds of QPST.

  • Baffles MSL Grabber (you can find it here: http://www.baf.cc/bafmsl you will need .net framework 3.5 installed on your phone)
Here's a link to .net Compact Framework 3.5 : http://www.microsoft.com/Downloads/details.aspx?familyid=E3821449-3C6B-42F1-9FD9-0041345B3385&displaylang=en

The unlocker prepares the phone for all the shenanigans
The Verizon Configurations and programs.
there are more current PRLs than the one listed. see FAQ below.
This link may be dead......See FAQ about DMU Keys.
A couple things you'll need to know during the process. Don't ask....just know.
DMR mode
for
sprint is ##3424#, for vzw ##3424 and press the send key
EPST for
sprint is ##778# , for verizon ##778 and hit the send key


Getting to DMR and EPST are critical for this process to work. There have been reports that custom dialer skins inhibit these from working correctly. Uninstall any dialer skins on the phone. You should be using the normal standard dialer.




Step Zero
You will need .Net 3.5 on the phone, most newer software require it...You need to install this on the phone. There are cab installers (phone) and exe installers (computer). You'll need to do this before you even start this process.


Step One
You can perform this step on your phone.
Install Baffles MSL Grabber
Copy .cab file to the phone and run it.
The software will install and put a shortcut probably in your Programs.
Then run the software.
and write your MSL.
This is basically pressing a single button on the application.
My suggestion is to open up a text document and type it there because it will be necessary later on.

Step Two
Unlock your device using the Raphael team elite unlocker for
sprint.
I used the second link (I believe .37).
Make sure your computer is connected to the device using Active Sync (XP) or Mobile Device Center (Vista).
This is a program you will run from your computer.
It will unlock the ROM on the device.

Step Three
Install the htc modem drivers on your computer (that's kind of important)
I think these are important because they will allow your computer to talk to the phone during the programming stage. Active Sync and MDC don't work while we do the low level stuff.

Step Four
Install QPST on your computer

Step Five
If you completed all the preliminary steps, you should be ready to fully begin. At this point, you can perform the steps on the vzw leaked rom or on your
sprint touch pro rom. If you are performing this on the sprint touch pro rom, you will need DCD carriers cab. On the vzw rom, however, I have noted that MMS does work on the phone (and you know how much we love our mms). I think this is solely up to you whether or not you use either rom for operation. Remember though, if you are doing this on a sprint rom

This post has pretty good information about what we're doing here:
How To: Use another carriers HTC on VZW


Place your phone in DMR mode. (##3424, ##3424#)
Connect your phone to your computer via usb mode.
If everything worked okay, the popup for drivers shouldn't come up at all.

Step Five dot Two
On your computer,
Start QPST config and select ports
Check FAQ below if you have issues

Step Six (Port Selection Troubleshooting)
Now, in QPST, your phone should come up. If it doesn't, right click on my computer and select properties. Click hardware and then device manager. Click view and device by connection. Click on your USB controllers and don't stop until you see HTC. Notice the com port that the HTC device is on (mine on two different computers, running xp or vista was COM5, yours may be different). Take a note of this and return to QPST config. Now, click add COM port, and add the port you saw in the device manager. QPST will pick up the phone.

Step Seven
Click on services
Go to services programming.
Select your phone and begin.
This will ask for your MSL.
Type in MSL and continue.
Click read from phone.
You may have to retype that MSL code, if not good. but on some cases, it asked me for my MSL code twice (unfortunately) so I typed it in twice. The point of it all is this - to get the data from your phone to QPST

Step Eight - changing your MSL
Now that you are in QPST Service programming, you can change your MSL unlock code.
Please change it to 000000.
That is vzw's MSL code, and it is so easy to remember for later on.
Click write to phone.
You will know when this is done if you can see that the buttons read from phone, write to phone, are not grayed out.
I caution, do not close out of QPST service programming until this is done!

Step Nine (optional)
Okay so at this point,
Installed the leaked vzw rom
but it is not necessary to perform this step at all. Its just something I did to make things a lot easier on me. Individual results can vary though.

Step Ten
Now, its time to change our MIP settings.
On your phone, Go into EPST (##778, ##778#) and select your MIP profile.
On your phone you can edit the information to match the following:

MIP Profile
Number of profiles: 6
Active user profile index: 0
MIP_MODE: Mobile IP Prefered
MIP Reg Retries: 2
MIP Reg Retry: 1750 ms
MIP Pre-Reg Timeout: 0
Mobile Node-HA: Enable
Send A Reg: Disable
Dormant Handoff Opt: Enable

Step Eleven
In EPST, go to MIP default profile
and edit the information on your phone to match these settings:

MIP Default Profile
Enable Profile: Enable
NAI:
cellnumber@vzw3g.com (MDN@vzw3g.com)
DUN NAI:
(cellnumber@vzw3g.com to tether without a tethering package or cellnumber@dun.vzw3g.com if you want paid tethering))
MN HA SPI Set: Enable
MN HA SPI Value: 12C
MN AAA SPI Set: Enable
MN AAA SPI Value: 0 (requires a "2" here for 6800 and 6900)
Reverse Tunneling: Enable
Home Address: 0.0.0.0
HA Shared Secret: (erase whatever entry is here leave blank)
AAA Shared Secret: (erase whatever entry is here leave blank)
Primary HA Address: 255.255.255.255
Secondary HA Address: 255.255.255.255
DMU Pub Key: 10
MN Authenticator: 0

It is very important to erase the HA and AAA shared keys. We will return back to them momentarily

Step Eleven
There may be an alternative method to this...see FAQ below

Complete changes from EPST and the device will soft reset.
Now place your phone in diag (DMR) mode (##3424, ##3424#)
Connect your phone to your computer and
Enter QPST EFS explorer.
Unzip the DMU keys and
notice you will see the file on your hard drive. In EFS explorer, you will see the DMU folder.
Right click on the folder and
You will be able to insert a DMU key via the file explorer on your computer.
Select the DMU key file and press okay.
The information will be written to the phone.

Step Twelve
Drag your PRL file you downloaded from your computer to your cell phone memory.
Dial ##PRL and hit send if you are on vzw rom,
##PRL# Send if you are still on the sprint rom.
This will lead to a dialog box on your phone that will allow you to locate the PRL file you loaded onto your phone. Make sure the PRL is in a directory where you can access it when you browse for it on your phone.

Step Thirteen
Place your phone back in diag
(DMR) mode (##3424, ##3424#).
Connect to QPST service programming and go to the MIP default profile
(AAA shared secret and HA shared secret is where you need to go in Service programming).
If there is anything in those two areas, delete it, click enter hex values and leave it blank.
Write to phone.

Step Fourteen
If you are still on a
sprint phone, install DCD vzw carrier cab.
If not, please dial *228.
The menu has changed, so you will have to hear EVERY option before selecting.
You will enter option number 3.
Go through the prompts on vzw's end and
the phone will program and soft reset.

Step Fifteen
Once your phone has soft reset, you're almost done! You should have text messaging and voice, but data not yet. So to get data, you have some options.
If you can't get data to authenticate, follow step thirteen.
Then force the phone into 1x mode
(I don't care how you do it - what I did was go to a mall basement)
Connect to the internet in 1x mode.
EvDO won't work, but 1x does work. What is going to happen is the HA and AAA shared keys will be written to the phone by the network. If all goes well, you should have your sprint touch pro phone 99.9% working on vzw network.


FAQ and Troubleshooting

If the settings don't stick after a hard reset try this:

There is a bug in the herman.core where the autorun.exe causes your programming the reset back to sprint in the ppckitchen. Remove the autorun.exe from the herman.core and it wont reset your settings. Thanks to NexVision for pointing it out.

I just got my data to work.
-Called verizon and asking them to reset my DMU keys. They did no problem.
-I did *228 opt 1.
-Forced the phone into 1X mode which gave me internet
-Browsed around some
-Went back to EVDO


Another Option for data not working:
I have no advice on MMS but data is now on my pro. I switched my account to my old phone (not actually a verizon phone either...) then back to my pro and data suddenly worked. Didn't have to copy data passwords. Thanks everyone.

DMU Keys Alternative Method

I just got my data working after several hours. For those of you out there that are not able to get it working, maybe this will help. I followed all the suggestions:

*228 option 3 on old phone, *228 option 3 on new phone
DMU reset, *228 option 1 on new phone
turning phones off, on, and changing EIN on vzw.com
force 1x mode, then try network (no connection)
update password, etc. in network settings

Nothing worked. Finally I realized my problem.

I had skipped option 11. I did it on purpose because the DMU link is broken. After I saw it was broken, I had looked through the forums until I found the suggestion of 1x connection to pull DMU keys. I had assumed that this would replace step 11. However, step 11 is a must. The DMU public keys must be on your phone before you can hope to pull any keys or even connect. I am baffled as to why that post has not been updated to point to the DMU keys, as they are quite necessary. I finally found them here:

http://forum.ppcgeeks.com/attachment...8&d=1229181632

in case the link dies again, it is the 4th post on this thread:

http://forum.ppcgeeks.com/showthread...174#post202174

or this post:

http://forum.ppcgeeks.com/showpost.p...12&postcount=4

After this you need to use EFS explorer to put "10.key" in your DMU folder. You can just drag it in. After that I did a *228 option 1 (again, because I had already finished all other steps), and it worked! I didn't even have to force 1x mode, but I did that anyway to be safe.

After this it seems to work fine, although QPST still shows no keys, ##778 does show that there are keys in there. And I have data!

-Dan
http://forum.ppcgeeks.com/showthread.php?t=44663&highlight=diag+mode&page=63

Another DATA Related Success Story:
Quote:
Originally Posted by DKSE View Post
I did a hard reset(while on the leaked Verizon rom) and had to re-do all of my settings. Now I have Voice and Text but no Data. I have read all 83 pages of this thread and tried everything even remotely relevant to data. Somebody plz help.
Scratch that the option I saw earlier worked perfect -sorry forgot who posted it-. Activate your old phone for at least 10 minutes, then activate your Touch Pro and the HA and AA keys should get written. *Note: To be on the safe side I went into EPST (##778 > Edit > enter your MSL which you should have set to 000000) > Modem settings (Locate via left soft-key) > Disable that HDN or whatever its called and set preffered system to CDMA only. Then go on the internet for like 45 seconds. After you've been connected go back into EPST and set the modem settings back to what they were.


New PRL to fix the Roaming triangle:
Found this forum with a link to the most recent modified PRL (51190) that eliminates the Roaming triangle from Sprint Touch Pros on the Verizon network. http://forum.ppcgeeks.com/showthread.php?t=50076 . Used it on my phone and it works perfectly. Also, read that forum for some great information about PRLs.

This PRL is newer than the 51143 and the 51101 PRLs on this forum I believe.


http://forum.ppcgeeks.com/showthread.php?t=44663&page=79


For QPST not finding the port.....

Yea, sometimes you have to just keep adding ports until you hit the right one.

It doesn't hurt anything to add them.

~John

1 comment:

Alan said...

Have you tried this yet and gotten it to work?

Thanks!