GSM-Forum - View Single Post - ASK->RPL DCT4 Algorithm

Al · 11-12-2010, 07:40

Many time gone and seems it's time to make it public....

If anyone remember, there are was thread looong time ago about it: http://forum.gsmhosting.com/vbb/f139...58/#post960572

Many doubts was, BUT Zulea was right that time

Here is working link to that file.

For first you should know how to decrypt/encrypt RPL data, that also can be found in that file. SAFER-K64 algo is at 000031A2 (Decode), 00002FC2 (Encode).

To build up RPL file, you should know only IMEI to calculate correct data and ASIC to encode that data.

In calculating RPL the main is UEM data, since WDPass for Flash data is just only 4 bytes which are calculated from UEM data and 2 another bytes

If you ever seen decoded RPL data in RAW, you should find out that in UEM data there is only first 16 bytes is different, the other is constant. That constant data isn't just constant, it's also calculated and it's algo that can be found at 00002D74. The 2nd 8 bytes in UEM data is just IMEI, so nothing interesting here

The first 8 bytes of UEM is done at 00002A38 and 00002B48. 4 different algorithms used to get these bytes, Nokia are paranoics

After you got UEM data, process with WDPass it's very easy to calc it now, proceed at 00002C50

After creating UEM & Flash data dont forget to encode it with correct ASIC

With that info you can build up an ASK->RPL calculator for ASICs 2,5,6,7. ASIC11 uses another key and a little bit another algo, which can't be found there.

Enjoy!

PS For provided TDS6.BIN thanx goes to Zulea, without it ASK->RPL for DCT4 won't be possible for free for many amounts of users

PPS There is also some interesting things in that file....

11-12-2010, 07:40	#1 (permalink)
Al Freak Poster Join Date: Nov 2002 Location: Russia Age: 43 Posts: 278 Member: 18270 Status: Offline Sonork: 100.109968 Thanks Meter: 106	ASK->RPL DCT4 Algorithm Many time gone and seems it's time to make it public.... If anyone remember, there are was thread looong time ago about it: http://forum.gsmhosting.com/vbb/f139...58/#post960572 Many doubts was, BUT Zulea was right that time Here is working link to that file. For first you should know how to decrypt/encrypt RPL data, that also can be found in that file. SAFER-K64 algo is at 000031A2 (Decode), 00002FC2 (Encode). To build up RPL file, you should know only IMEI to calculate correct data and ASIC to encode that data. In calculating RPL the main is UEM data, since WDPass for Flash data is just only 4 bytes which are calculated from UEM data and 2 another bytes If you ever seen decoded RPL data in RAW, you should find out that in UEM data there is only first 16 bytes is different, the other is constant. That constant data isn't just constant, it's also calculated and it's algo that can be found at 00002D74. The 2nd 8 bytes in UEM data is just IMEI, so nothing interesting here The first 8 bytes of UEM is done at 00002A38 and 00002B48. 4 different algorithms used to get these bytes, Nokia are paranoics After you got UEM data, process with WDPass it's very easy to calc it now, proceed at 00002C50 After creating UEM & Flash data dont forget to encode it with correct ASIC With that info you can build up an ASK->RPL calculator for ASICs 2,5,6,7. ASIC11 uses another key and a little bit another algo, which can't be found there. Enjoy! PS For provided TDS6.BIN thanx goes to Zulea, without it ASK->RPL for DCT4 won't be possible for free for many amounts of users PPS There is also some interesting things in that file....