GSM-Forum - View Single Post - Problems in Unlock 5800, N85, N96 Ver 30.0.11 and 31.0.8

moulnisky · 09-16-2009, 11:38

NOTE : This solution is now obsolete as the new Cyclone update can unlock these mobile directly (Won't use any logs) I keep it here as can be used to unlock them, when possible, if the rpl system doesn't work and as it is still the only solution to restore the PM308 back-ups in these mobiles

Is happening always more often people opening threads for problems in unlock of rapido SL2 like the 5800 with firmware 30.0.11 or 31.0.8
This version of firmware, if we try to unlock using the NCK codes gives you error BB5 Unlock Failed -> Failed to get Lock Key (6, 5)
The only mode we have at the moment to unlock it is via downgrade.

Not all the models can be unlocked using this system!! before you start is better to check if it can be done or not: how to?
Just read the PM and make the simlock RPL using the function "create RPL frm PM": if the simlock_key_data are 3 lines, it can be done. If are 8 lines no chances.

The steps for a safe Downgrade, unlock ad re-update are simple but must be done in the exact sequence.
A) made all the back-ups (Tab Common/info "READ PM", tab BB5/Security "CREATE RPL FROM PHONE" and tab BB5/Security "READ ALL CERTS") plus a Simlock rpl using the function "create RPL from PM" and selecting the PM back-up.
B) Dowload the firmware versions you need for the job 21.0.25 for the downgrade and 30.0.11 or 31.0.8 (Depending the actual version of the mobile) for the re-upgrade and this recovery kit which must be unzipped in the common firmware folder as E71 (normally c:\Program files\Nokia\Phoenix\Products\RM-346).
C) Downgrade the mobile to the version 21.0.25 using the files related to the original product code of the mobile
D) In the tab bb5/security Thick "plain RPL" and write the Security RPL you made doing "create RPL from PM"
E) Unlock the mobile using the NCK codes (Keep a copy of the calculate codes in a side)
F) flash the mobile with the erase file 5800_Erase_256MB_kashi4gul with "Skip APE" Thicked.
G) flash the mobile as E71 v300 product code 0559569 with "skip APE" thicked ONLY COR and PPM.
the mobile now should be readable and you can see the infos with damaged imei as you are working on a RM-346; if you can't read the infos or the mobile just vibrate if you try to power it on manually flash it using the RM-356 ENO file included in the recovery package (Skip APE Thicked) and flash again the MCU E71 in the mobile (Skip APE Thicked)
H) write the full PM you have from the original back-up
I) flash it again with the 5800 firmware V30 or 31 was in origin in the mobile
J) write back the FULL RPL Back-up
if you now read the infos in the mobile the logs will be perfect with the mobile locked again as before
K) go in the tab BB5 security and click on sx4 auth.. the mobile should get the sx4 auth without any problem
L) go in the tab common/info, SX4 bypass NOT THICKED and click on write PM selecting full PM back-up you made in origin
M) go in the tab bb5/security and in the area NCK input via Fbus the unlock code calculated #pw+..+7#
Job done.. you can connect the battery back and test the mobile

Note : procedure revised to be sure the mobile is 100% without watch dog problems
Note 2 : for the N85 the procedure is the same, just after the point "E", once you got the unlocking code, go directly to the step 1 of this post : http://forum.gsmhosting.com/vbb/show...&postcount=127
Note 3 : for the N96 the procedure is the same, just after the point "E", once you got the unlocking code, go directly to the step 1 of this post : http://forum.gsmhosting.com/vbb/show...1&postcount=81

BR

Alex

09-16-2009, 11:38	#1 (permalink)
moulnisky No Life Poster Join Date: Jan 2009 Location: England Age: 59 Posts: 17,681 Member: 947561 Status: Offline Thanks Meter: 14,053	Problems in Unlock 5800, N85, N96 Ver 30.0.11 and 31.0.8 NOTE : This solution is now obsolete as the new Cyclone update can unlock these mobile directly (Won't use any logs) I keep it here as can be used to unlock them, when possible, if the rpl system doesn't work and as it is still the only solution to restore the PM308 back-ups in these mobiles Is happening always more often people opening threads for problems in unlock of rapido SL2 like the 5800 with firmware 30.0.11 or 31.0.8 This version of firmware, if we try to unlock using the NCK codes gives you error BB5 Unlock Failed -> Failed to get Lock Key (6, 5) The only mode we have at the moment to unlock it is via downgrade. Not all the models can be unlocked using this system!! before you start is better to check if it can be done or not: how to? Just read the PM and make the simlock RPL using the function "create RPL frm PM": if the simlock_key_data are 3 lines, it can be done. If are 8 lines no chances. The steps for a safe Downgrade, unlock ad re-update are simple but must be done in the exact sequence. A) made all the back-ups (Tab Common/info "READ PM", tab BB5/Security "CREATE RPL FROM PHONE" and tab BB5/Security "READ ALL CERTS") plus a Simlock rpl using the function "create RPL from PM" and selecting the PM back-up. B) Dowload the firmware versions you need for the job 21.0.25 for the downgrade and 30.0.11 or 31.0.8 (Depending the actual version of the mobile) for the re-upgrade and this recovery kit which must be unzipped in the common firmware folder as E71 (normally c:\Program files\Nokia\Phoenix\Products\RM-346). C) Downgrade the mobile to the version 21.0.25 using the files related to the original product code of the mobile D) In the tab bb5/security Thick "plain RPL" and write the Security RPL you made doing "create RPL from PM" E) Unlock the mobile using the NCK codes (Keep a copy of the calculate codes in a side) F) flash the mobile with the erase file 5800_Erase_256MB_kashi4gul with "Skip APE" Thicked. G) flash the mobile as E71 v300 product code 0559569 with "skip APE" thicked ONLY COR and PPM. the mobile now should be readable and you can see the infos with damaged imei as you are working on a RM-346; if you can't read the infos or the mobile just vibrate if you try to power it on manually flash it using the RM-356 ENO file included in the recovery package (Skip APE Thicked) and flash again the MCU E71 in the mobile (Skip APE Thicked) H) write the full PM you have from the original back-up I) flash it again with the 5800 firmware V30 or 31 was in origin in the mobile J) write back the FULL RPL Back-up if you now read the infos in the mobile the logs will be perfect with the mobile locked again as before K) go in the tab BB5 security and click on sx4 auth.. the mobile should get the sx4 auth without any problem L) go in the tab common/info, SX4 bypass NOT THICKED and click on write PM selecting full PM back-up you made in origin M) go in the tab bb5/security and in the area NCK input via Fbus the unlock code calculated #pw+..+7# Job done.. you can connect the battery back and test the mobile Note : procedure revised to be sure the mobile is 100% without watch dog problems Note 2 : for the N85 the procedure is the same, just after the point "E", once you got the unlocking code, go directly to the step 1 of this post : http://forum.gsmhosting.com/vbb/show...&postcount=127 Note 3 : for the N96 the procedure is the same, just after the point "E", once you got the unlocking code, go directly to the step 1 of this post : http://forum.gsmhosting.com/vbb/show...1&postcount=81 BR Alex Last edited by moulnisky; 01-20-2010 at 20:52.