- Joined
- Nov 26, 2020
- Messages
- 716
Not really easy. There are special terms and sometimes strained convolutions.
Intro:I'm not sure what the majority of those present will be interested in, but as it turned out during one discussion, there is interest in the topic and it's worth a try. Of course, you can buy a new phone once a week or give an existing one to a specialist you know. But the former increases the entropy of the Universe, and a familiar specialist can refer to being busy. It also turned out that on the mobile forums, questions and answers about changing the serial are not in vogue, because the moderators reward such clever people with a ban. So to speak, so that they steal less and then unlock them.
Therefore, I learned about the possibility of changing IMEI in Siemens x65, except for replacing the flash drive, quite late, when I had already switched to Samsung's slim. But he didn't sell his M65 and didn't throw it away, and therefore he took part in the MA-8730P USB cable described below. It also turns out that on x65 you can listen to mp3 and run elf binaries instead of Java midlets. Cool, but it's from a different opera.
So three programs are required: PapuaUtils for working with phone codes, V_Klay patcher and x65flasher flasher. V_Klay can work as a flasher, but it has a smaller range of lace speeds, and it works subjectively slower.
Keys.
First you need to run PapuaUtils and calculate the keys. It is optimal to do this through the px75v1 midlet. You need to put it into your phone and run it there. With the HASH and ESN torn out, run the calculation of SKEY and BootKEY (BKEY) in PapuaUtils. It is advisable to bury all received keys in a safe place (also ESN for x65flasher). Because if the bodies are killed, and there will be no native full flash (it was considered crooked or it is not clear how it left), this is at least some hope that the device will then return to life through non-trivial efforts. Next, write the found BKEY into the V_Klay loader (file x65.vkd, everything is written in it there).
Backup.
Run Clay. When you first connect to the phone, he will try to make a full backup, let him do it. Also x65flasher (which is amazing) and PapuaUtils (the 'flash' tab) can do it.
Disable hardware IMEI check.
The first option is easy. Google the program x65_IMAI_changer (namely IMAI). Pull out a piece of memory 0x40000 from the phone with Glue, starting from address zero. For x75, starting at 0x40000. Feed the received file to this changer by pressing the 'Disable OTP' button in it. The changer will immediately offer to save the result: put the file next to it, adding the _patched label to its name. And that's all. You should not follow further advice in the instructions for the changer, they are designed for a firmware version no higher than 25. Ha, 43, and 50, and 58 are sewn (M65 in the sense).
Option two, manually. In fact, the changes made are minimal. It's easier to show on patches for specific firmware found when comparing files:
Code:
; M65_v50
+0; address modifier means patch starting from here
0x03B1F8: 04 0D
0x03B1FC: 0D 04
0x03B200: C70A FA0B; addition from 3301 within WORD
0x03B203: FA EB
0x03B20B: 0A EA
; M65_v58
+0
0x03B1C0: 04 0D
0x03B1C4: 0D 04
0x03B1C8: D10B 040D; for some reason 3302. if you add it cyclically, you should get 040C. HZ
0x03B1CB: FA EB
0x03B1D3: 0A EA
; M75_v12
+ 0x40000
0x01B240: 04 0D
0x01B244: 0D 04
0x01B248: 844D B74E; ugum, and here 3301
0x01B24B: FA EB
0x01B253: 0A EA
+0
; ME75_v19
+ 0x40000
0x01B1D8: 04 0D
0x01B1DC: 0D 04
0x01B1E0: 8FC2 C2C3; similarly, Watson
0x01B1E3: FA EB
0x01B1EB: 0A EA
In general, look for the second sequence 0x0410A0E10D00A0E1, this is the beginning of the patch. You can look at the file in the hex, make sure. For example, the changer could not find anything in the file from S65_v58. Switch Glue from phone mode to file mode. We open full flash (of course, a copy for experiments!). And we write the file issued by the changer into this full flash at the address from which it was taken. In the manual version, just patch it as described above. You can even get those patches, if the model and version coincide with any of them. The resulting full flash can then be reused. But old SMS messages, contacts in the address book and so on will be frozen in it.
Helpful but not required
Since we work with full flash, the loss of EEPROM is not terrible. Still, it would be nice to open a few hidden blocks related to IMEI for the future. You never know what buttons in the special software you want to press. Therefore, we will apply a small patch just in case (only to the specified firmware version! Search rules):
Code:
; phone_model: M65
; sw: 50
; info: Open locked EEPROMs
; web: http://allsiemens.com/
; (c) Skylord
125F180: 00 01
Changing IMEI
Next, let's take on PapuaUtils again. On the 'Miscellaneous' tab, the program has a 'Mill' area. Actually, it is designed to write IMEI to the phone if the flash drive is zero. The phone is turned off, enter the desired IMEI in the window and click 'Freeze'. The program remembers the number and go to the 'Converter' tab, where the 'Recalk FullFlash' button is found. This is a correct and correct modification of a full flash for the new IMEI, in contrast to the aforementioned changer. Plus works on all versions.
Phone recording
The hardest part is over. It is better to use x65flasher for recording. We calculate or substitute BKEY and write full flash to the phone. If it's crooked, the phone will beep when turned on and turn off back. An overspeed may have been selected. Then rewrite on a new one. And so the device should turn on as usual. We check * # 06 #, it seems to have changed. We check through PapuaUtils (Settings-> Information), writes that it does not correspond to the hardware IMEI. Well, actually what they wanted. Whoever has a megaphone SIM card, they say, can check in the details of the bill.
IMEI Calculation
Optional. You can score with zeros. But you can specify Vertu or A35 (like, don't touch a sucker, haha). A general list of manufacturers is here:
http://www.nobbi.com/tacquerydb.htm
Description of fields is here:
http://en.wikipedia.org/wiki/IMEI
The checksum calculation can be done quickly here:
http://javascript.internet.com/forms...alidation.html
Yes, yes, for cards the last digit is also calculated by Luhn's formula.
The programs used are freeware and were taken from the following places:
http://vi-soft.com.ua
http://papuas.allsiemens.com/PapuaUtils.htm
http://chaos.allsiemens.com/software.html
x65_IMAI_changer is located by Google on forums that require registration to download.
Intro:I'm not sure what the majority of those present will be interested in, but as it turned out during one discussion, there is interest in the topic and it's worth a try. Of course, you can buy a new phone once a week or give an existing one to a specialist you know. But the former increases the entropy of the Universe, and a familiar specialist can refer to being busy. It also turned out that on the mobile forums, questions and answers about changing the serial are not in vogue, because the moderators reward such clever people with a ban. So to speak, so that they steal less and then unlock them.
Therefore, I learned about the possibility of changing IMEI in Siemens x65, except for replacing the flash drive, quite late, when I had already switched to Samsung's slim. But he didn't sell his M65 and didn't throw it away, and therefore he took part in the MA-8730P USB cable described below. It also turns out that on x65 you can listen to mp3 and run elf binaries instead of Java midlets. Cool, but it's from a different opera.So three programs are required: PapuaUtils for working with phone codes, V_Klay patcher and x65flasher flasher. V_Klay can work as a flasher, but it has a smaller range of lace speeds, and it works subjectively slower.
Keys.
First you need to run PapuaUtils and calculate the keys. It is optimal to do this through the px75v1 midlet. You need to put it into your phone and run it there. With the HASH and ESN torn out, run the calculation of SKEY and BootKEY (BKEY) in PapuaUtils. It is advisable to bury all received keys in a safe place (also ESN for x65flasher). Because if the bodies are killed, and there will be no native full flash (it was considered crooked or it is not clear how it left), this is at least some hope that the device will then return to life through non-trivial efforts. Next, write the found BKEY into the V_Klay loader (file x65.vkd, everything is written in it there).
Backup.
Run Clay. When you first connect to the phone, he will try to make a full backup, let him do it. Also x65flasher (which is amazing) and PapuaUtils (the 'flash' tab) can do it.
Disable hardware IMEI check.
The first option is easy. Google the program x65_IMAI_changer (namely IMAI). Pull out a piece of memory 0x40000 from the phone with Glue, starting from address zero. For x75, starting at 0x40000. Feed the received file to this changer by pressing the 'Disable OTP' button in it. The changer will immediately offer to save the result: put the file next to it, adding the _patched label to its name. And that's all. You should not follow further advice in the instructions for the changer, they are designed for a firmware version no higher than 25. Ha, 43, and 50, and 58 are sewn (M65 in the sense).
Option two, manually. In fact, the changes made are minimal. It's easier to show on patches for specific firmware found when comparing files:
Code:
; M65_v50
+0; address modifier means patch starting from here
0x03B1F8: 04 0D
0x03B1FC: 0D 04
0x03B200: C70A FA0B; addition from 3301 within WORD
0x03B203: FA EB
0x03B20B: 0A EA
; M65_v58
+0
0x03B1C0: 04 0D
0x03B1C4: 0D 04
0x03B1C8: D10B 040D; for some reason 3302. if you add it cyclically, you should get 040C. HZ
0x03B1CB: FA EB
0x03B1D3: 0A EA
; M75_v12
+ 0x40000
0x01B240: 04 0D
0x01B244: 0D 04
0x01B248: 844D B74E; ugum, and here 3301
0x01B24B: FA EB
0x01B253: 0A EA
+0
; ME75_v19
+ 0x40000
0x01B1D8: 04 0D
0x01B1DC: 0D 04
0x01B1E0: 8FC2 C2C3; similarly, Watson
0x01B1E3: FA EB
0x01B1EB: 0A EA
In general, look for the second sequence 0x0410A0E10D00A0E1, this is the beginning of the patch. You can look at the file in the hex, make sure. For example, the changer could not find anything in the file from S65_v58. Switch Glue from phone mode to file mode. We open full flash (of course, a copy for experiments!). And we write the file issued by the changer into this full flash at the address from which it was taken. In the manual version, just patch it as described above. You can even get those patches, if the model and version coincide with any of them. The resulting full flash can then be reused. But old SMS messages, contacts in the address book and so on will be frozen in it.
Helpful but not required
Since we work with full flash, the loss of EEPROM is not terrible. Still, it would be nice to open a few hidden blocks related to IMEI for the future. You never know what buttons in the special software you want to press. Therefore, we will apply a small patch just in case (only to the specified firmware version! Search rules):
Code:
; phone_model: M65
; sw: 50
; info: Open locked EEPROMs
; web: http://allsiemens.com/
; (c) Skylord
125F180: 00 01
Changing IMEI
Next, let's take on PapuaUtils again. On the 'Miscellaneous' tab, the program has a 'Mill' area. Actually, it is designed to write IMEI to the phone if the flash drive is zero. The phone is turned off, enter the desired IMEI in the window and click 'Freeze'. The program remembers the number and go to the 'Converter' tab, where the 'Recalk FullFlash' button is found. This is a correct and correct modification of a full flash for the new IMEI, in contrast to the aforementioned changer. Plus works on all versions.
Phone recording
The hardest part is over. It is better to use x65flasher for recording. We calculate or substitute BKEY and write full flash to the phone. If it's crooked, the phone will beep when turned on and turn off back. An overspeed may have been selected. Then rewrite on a new one. And so the device should turn on as usual. We check * # 06 #, it seems to have changed. We check through PapuaUtils (Settings-> Information), writes that it does not correspond to the hardware IMEI. Well, actually what they wanted. Whoever has a megaphone SIM card, they say, can check in the details of the bill.
IMEI Calculation
Optional. You can score with zeros. But you can specify Vertu or A35 (like, don't touch a sucker, haha). A general list of manufacturers is here:
http://www.nobbi.com/tacquerydb.htm
Description of fields is here:
http://en.wikipedia.org/wiki/IMEI
The checksum calculation can be done quickly here:
http://javascript.internet.com/forms...alidation.html
Yes, yes, for cards the last digit is also calculated by Luhn's formula.
The programs used are freeware and were taken from the following places:
http://vi-soft.com.ua
http://papuas.allsiemens.com/PapuaUtils.htm
http://chaos.allsiemens.com/software.html
x65_IMAI_changer is located by Google on forums that require registration to download.
