View Full Version : E71 unlock problem
i try to unlock 2 phones E71 but no SKey.
I used BSReader and have the hash+esn keys, but papuautils cannot calculate skey, tried with tp but no success. any idea to calculate this skey ?
i try to unlock 2 phones E71 but no SKey.
I used BSReader and have the hash+esn keys, but papuautils cannot calculate skey, tried with tp but no success. any idea to calculate this skey ?
Hi,
I have somme questions:
-which version of papuautils you used?
-If you used BsReader midlet with papuautils, normarly needed to automatically write ESN and HASH inside (in the papuautils case).
-which firmware you haved inside in the phone?
dagos
tried with ver.38dEng, 77Eng and 111a197.
can u explain more how to write automatically ESN and HASH inside ?
thx in advance for your help
Hi,
I have somme questions:
-which version of papuautils you used?
-If you used BsReader midlet with papuautils, normarly needed to automatically write ESN and HASH inside (in the papuautils case).
-which firmware you haved inside in the phone?
dagos
tried with ver.38dEng, 77Eng and 111a197.
can u explain more how to write automatically ESN and HASH inside ?
thx in advance for your help
Hi (again),
I you know ESN, (readed directly from the phone), write in the papuautls case in the following order:
-ESN from the phone: A1B2-C3F4
-write in the papuautils: F4C3-B2A1
Instruction for unlocking used PapuaUtils
(Detailes provided by Hacktek)
http://forum.gsmhosting.com/vbb/showpost.php?p=1982023&postcount=2
-USE DATA CABLE- with SiMoCo (or the other Phone Manager)
..and never disconect the cable!
- Copy Viper or bsReader(Viper.jar or bsReader.jar to phone in: "Data\Java\jam\Applications"
- start aplication (into phone) -» Data\Applications-»Viper (or bsReader)
- Confirm local conexion 'By Session'.
- Confirm acess aplication java to data cable.
-Wait few seconds (or minutes).
- wait for a 'beep' and the IMEI/ESN/HASH should in phone.
-dont touch nothing and run x65flasher-1072 (or the other X65 flasher version).
-click connect, so the 'keys' calculate starts. wait the calculate.
- start x65PapuaUtils and click button 'PX65V4' - program starts receiving imei/esn/hash from java aplication.
- Click "Calculate Skey and Bkey' and wait skey e a bkey to be calculated
- turn off the phone,
-USE UNLOCK CABLE
- GO 'ServiceMode'.
- click'Enter Skey to phone'.now all keys are saved
- Go'ServiceMode'.
-Enter Skey to phone', should appear 'FactoryMode'.
- Cick'Freia.log'. dont save the log, CANCEL. after that the prog ask if you want write blocks directly to phone. click Yes.
- Program write the blocks.
dagos
With BSReader i don't see where it asks to confirm local connexion "by session" ans so on, but with viper when press this connexion it gives connection failure.:confused:
Hi (again),
I you know ESN, (readed directly from the phone), write in the papuautls case in the following order:
-ESN from the phone: A1B2-C3F4
-write in the papuautils: F4C3-B2A1
Instruction for unlocking used PapuaUtils
(Detailes provided by Hacktek)
http://forum.gsmhosting.com/vbb/showpost.php?p=1982023&postcount=2
-USE DATA CABLE- with SiMoCo (or the other Phone Manager)
..and never disconect the cable!
- Copy Viper or bsReader(Viper.jar or bsReader.jar to phone in: "Data\Java\jam\Applications"
- start aplication (into phone) -» Data\Applications-»Viper (or bsReader)
- Confirm local conexion 'By Session'.
- Confirm acess aplication java to data cable.
-Wait few seconds (or minutes).
- wait for a 'beep' and the IMEI/ESN/HASH should in phone.
-dont touch nothing and run x65flasher-1072 (or the other X65 flasher version).
-click connect, so the 'keys' calculate starts. wait the calculate.
- start x65PapuaUtils and click button 'PX65V4' - program starts receiving imei/esn/hash from java aplication.
- Click "Calculate Skey and Bkey' and wait skey e a bkey to be calculated
- turn off the phone,
dagos
After asking to "Allow java application to acess accessory?" when press yes i receive this message : Error Java.lang.NoClassDefFoundError:com/siemens/mp/io/File
what to do ?
After asking to "Allow java application to acess accessory?" when press yes i receive this message : Error Java.lang.NoClassDefFoundError:com/siemens/mp/io/File
what to do ?
...in this case write on the paper HASH and ESN, write manually in the phone; for ESN write in the phone D4C3-B2A1 (phone display in the following order ESN: A1B2-C3D4) and click to calculate SKEY.
dagos
i wrote it like this, but it gives "keys not founds" when i press to calculate SKEY+BOOTKEY.
and the version of this is 37.
...in this case write on the paper HASH and ESN, write manually in the phone; for ESN write in the phone D4C3-B2A1 (phone display in the following order ESN: A1B2-C3D4) and click to calculate SKEY.
dagos
i wrote it like this, but it gives "keys not founds" when i press to calculate SKEY+BOOTKEY.
and the version of this is 37.
...this is the normal. You used high version....
You need to use testpoint procedure:
-go to the "Flash" tab.
-chose Pause.
-chose 76,5008,5009,5077 in recalculate keys.
-Do the Job!
you must detach tp when ask "pause 2 seconde".
..and after few secconds your phone is unlocked.
Br,
dagos
thanks, can i give the correct pinout for unlock serial cable please ?
...this is the normal. You used high version....
You need to use testpoint procedure:
-go to the "Flash" tab.
-chose Pause.
-chose 76,5008,5009,5077 in recalculate keys.
-Do the Job!
you must detach tp when ask "pause 2 seconde".
..and after few secconds your phone is unlocked.
Br,
dagos
thanks, can i give the correct pinout for unlock serial cable please ?
...see bellow:
Pin1: + Power charger or Autoignition
Pin2:GND
Pin3:TX
Pin4:RX
dagos
this pinout is not correct for unlock serial cable, can u check it, please ,
GND is at pin5.
...see bellow:
Pin1: + Power charger or Autoignition
Pin2:GND
Pin3:TX
Pin4:RX
dagos
this pinout is not correct for unlock serial cable, can u check it, please ,
GND is at pin5.
...sorry it is true (E71 use Nano Lumberg connector):
Pin1: RTS (D+ for USB DCA140 cable)
Pin2: CTS (D- for USB DCA140 cable)
Pin3: TX
Pin4: RX
Pin5: GND
Pin6: DCD
Pin7: Ignition (power charger)
Pin8: GND Microphone
Pin9: MICEA
Pin10: Stereo2_Out
Pin11: Phantom_Buff_Out
Pin12: Stereo2_Out
dagos