| Use QXDM to reset SPC & set NAM to false
ASSUMING YOU HAVE SPC ALREADY
Using QXDM (ensure VIEW is set to COMMAND OUTPUT) type the following commands:
mode offline-d
Turns radio off and sets to service mode. Check phone radio is off.
spc "000000"
Replace asteriks with the 6 digit code u found using UniCDMA. Output should read successful.
nv_write nam_lock 0
(VERY IMPORTANT)
and some other command also try to disable min lock
the command for nam lock is:
nv_write nam_lock "disabled"
or
nv_write nam_lock disabled
or
nv_write nam_lock 0
can't remember very well
ESN REPAIR:
If the Value is 0x2A then Phone is ESN Based
If the Value is 0x3A then Phone is MEID Based
mode offline-d
RequestNVItemRead "lock_code"
RequestNVItemRead "sec_code"
RequestNVItemWrite "sec_code" "000000"
password ****************
RequestNVItemRead scm
RequestNVItemWrite scm 0x2a
RequestNVItemWrite scm 0x3a
RequestNVItemRead esn
RequestNVItemWrite esn 0x0 (This zeros ESN)
RequestNVItemWrite esn 0x00000000 (This zeros ESN)
RequestNVItemRead meid
RequestNVItemWrite meid 0x0000000000000000 (Use to zero)
RequestNVItemWrite meid 0x00a1000001234abc (use to write actual MEID)
mode reset
BB REG ID (set REGID to 2004)
requestnvitemidwrite 11055 0xD4 0x07
requestnvitemidwrite 11089 0x01 0xD4 0x07
(Join the two together in reverse (endian) and then proceed to convert it to decimal:
D4 07 (stored) converts to 07D4 (actual output) which is 2004 (decimal output))
Reset Call Timers:
RequestNVItemWrite "call_timer_g" 0
RequestNVItemWrite "life_timer_g" 0
RequestNVItemWrite "life_cnt" 0
RequestNVItemWrite "air_timer" 0 0
There is no easy way to write the PRL in 3.x |