BB5 - Technical Discussion - Page 4 - GSM-Forum

deesperado · 07-10-2005, 02:09

Quote:

Originally Posted by ppheonixx

could you please post the full document?

btw: I don't think anymore that the protected area (certificate, checksums, nokia private key) is of any importance concerning unlocking. I begin to believe that all this certificate fuss is about IMEI change; and I for instance couldn't care less, if this isn't possible on current and future phones.

Anyway, to get further here - could someone, who is very rich and doesn't care about money, buy this damn jtag interface from TI and post modem engine rom/ram contents as well as boot debugging trace files ? Thanx!

I have more details but the other pictures were sent by other guys...
but it´s sure that some people have started unlocking via DKU-2 cable....

B.R.
desperado

german gsm team · 07-10-2005, 02:15

Quote:

Originally Posted by deesperado

I have more details but the other pictures were sent by other guys...
but it´s sure that some people have started unlocking via DKU-2 cable....

B.R.
desperado

is this unlock by partial flash or by certificate recalculation?

deesperado · 07-10-2005, 02:25

Quote:

Originally Posted by german gsm team

is this unlock by partial flash or by certificate recalculation?

this works only with winlock 5 software and SX-5 Smartcard....
with SX-5 and right pin for this card you can calculate unlock codes...
and somebody have it

B.R.
desperado

german gsm team · 07-10-2005, 02:27

a card which can unlock every provider and not just one?

deesperado · 07-10-2005, 02:30

Quote:

Originally Posted by german gsm team

a card which can unlock every provider and not just one?

yes there is a small trick

and with certificate recalculation it does not work, this is already tested....

B.R.
desperado

german gsm team · 07-10-2005, 02:41

Quote:

Originally Posted by deesperado

take a look at the attachment for some info's about the new security concept.

btw, now direct unlock by cable started in London, Budapest and Dubai,
prices are falling every day... Just a matter of time to be free....

but how should it be free some day if one need a sx-5 smartcard?

i doubt that you cannot order this card as regular spare part

deesperado · 07-10-2005, 02:46

Quote:

Originally Posted by german gsm team

but how should it be free some day if one need a sx-5 smartcard?

i doubt that you cannot order this card as regular spare part

where you will get this smartcard?

yes you are right this is not deliverable as a spare part

B.R.
desperado

german gsm team · 07-10-2005, 02:47

so how should it become free then... security fault in gemplus smartcard ... complete java applet redable...???

deesperado · 07-10-2005, 02:52

Quote:

Originally Posted by german gsm team

so how should it become free then... security fault in gemplus smartcard ... complete java applet redable...???

ask dejan for this....

maybe he can put this free, because he is tired with unlocking BB5 .....

B.R.
desperado

uppwd2 · 07-10-2005, 07:04

Hi

I dont know what sx-5 smartcard is ?

Pls explain more.

B.R

hakika · 07-10-2005, 07:43

non non non mucho informacion -OVERLOAD

too much information ! no dont get tired just yet!

Zaihtam · 07-10-2005, 09:54

Dejan only gives us hints on what he is playing with, in this case JTAG. that's a expensive toys.

even you buy a JTAG, it is not easy at all to unlock. you got to start analyzing code. etc etc... there are many task to do. and it's only for expert, even expert got tired unlcoking BB5.

I heard zulea have cracked SEtools 3 Smart card, protection scheme. rumors said he can read all the memory inside the smart card. dunno if the sx smart card can be attack the same way. btw you got to have the smart card first before attack them.

attack on smart card have it's disadvantages, since you got have each operator's smart card lock algo. that mean we got collect them all like pokemon cards...

if attack success, smart card can be emulated, like the THerestial TV smart card.

, PKD can be replace by zulea PBB, and, anyone got winlock software?

Dejan any suggestion?

german gsm team · 07-10-2005, 11:01

Quote:

Originally Posted by Zaihtam

attack on smart card have it's disadvantages, since you got have each operator's smart card lock algo. that mean we got collect them all like pokemon cards...

i'm sure that the algo is the same for all operators but the configuration key is hardcoded in sx-5

when you look at the visual chip design, nokia uses gemplus cards, setool is schlumbrger

Zaihtam · 07-10-2005, 12:05

i'm sure that the algo is the same for all operators but the configuration key is hardcoded in sx-5

yeah, it sounds more logical.

any body ever log on this unlock process?

GSM Road Runner · 07-11-2005, 08:33

if we know that to unlock BB5 phones we need:

FPS-10 or DKU-2
WINLOCK 5.0 - why nobody have it?!!
smart-card.

so why not to try to get winlock 5.0 and try to crack it instead to try to develop opening tool?

07-11-2005, 08:33	#60 (permalink)
GSM Road Runner No Life Poster Join Date: Jan 2005 Location: On Roads... Age: 43 Posts: 643 Member: 107839 Status: Offline Sonork: 100.1592822 Thanks Meter: 70	why no-one try to crack winlock? if we know that to unlock BB5 phones we need: FPS-10 or DKU-2 WINLOCK 5.0 - why nobody have it?!! smart-card. so why not to try to get winlock 5.0 and try to crack it instead to try to develop opening tool?

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
x65 patching technical discussion	Acidmrp	x6x and x7x Flashpatching	42	10-10-2009 07:06
Iphone 3G Technical Discussion and SP Unlocking theory	GraveSlayer	iPhone 2 / iPhone 3G / iPhone 3GS	8	11-15-2008 06:04
Technical discussion sharp705sh	celluniversal	Sharp	0	05-17-2007 17:26
Technical discussion BB5 unlocking	twisterfan	Nokia Base Band 5 ( BB-5 )	0	05-16-2007 19:36
Patching: Technical Discussion ...	rizapn	x4x, x5x Flashpatching	282	10-03-2006 19:23

07-10-2005, 02:27	#49 (permalink)
german gsm team No Life Poster Join Date: Mar 2002 Location: Somewhere in the World Age: 54 Posts: 1,425 Member: 9848 Status: Offline Thanks Meter: 144	a card which can unlock every provider and not just one?

07-10-2005, 02:47	#53 (permalink)
german gsm team No Life Poster Join Date: Mar 2002 Location: Somewhere in the World Age: 54 Posts: 1,425 Member: 9848 Status: Offline Thanks Meter: 144	so how should it become free then... security fault in gemplus smartcard ... complete java applet redable...???

07-10-2005, 07:04	#55 (permalink)
uppwd2 Freak Poster Join Date: Feb 2005 Location: Now inside NHL-2NA Age: 50 Posts: 429 Member: 115864 Status: Offline Thanks Meter: 8	Hi I dont know what sx-5 smartcard is ? Pls explain more. B.R

07-10-2005, 07:43	#56 (permalink)
hakika No Life Poster Join Date: Sep 2001 Location: Palestine-Iraq-Afghanistan.... Age: 25 Posts: 532 Member: 6478 Status: Offline Thanks Meter: 3	non non non mucho informacion -OVERLOAD too much information ! no dont get tired just yet!

07-10-2005, 09:54	#57 (permalink)
Zaihtam No Life Poster Join Date: Dec 2004 Location: 0x001FD00 Posts: 1,285 Member: 98572 Status: Offline Thanks Meter: 36	Dejan only gives us hints on what he is playing with, in this case JTAG. that's a expensive toys. even you buy a JTAG, it is not easy at all to unlock. you got to start analyzing code. etc etc... there are many task to do. and it's only for expert, even expert got tired unlcoking BB5. I heard zulea have cracked SEtools 3 Smart card, protection scheme. rumors said he can read all the memory inside the smart card. dunno if the sx smart card can be attack the same way. btw you got to have the smart card first before attack them. attack on smart card have it's disadvantages, since you got have each operator's smart card lock algo. that mean we got collect them all like pokemon cards... if attack success, smart card can be emulated, like the THerestial TV smart card. , PKD can be replace by zulea PBB, and, anyone got winlock software? Dejan any suggestion?

07-10-2005, 12:05	#59 (permalink)
Zaihtam No Life Poster Join Date: Dec 2004 Location: 0x001FD00 Posts: 1,285 Member: 98572 Status: Offline Thanks Meter: 36	i'm sure that the algo is the same for all operators but the configuration key is hardcoded in sx-5 yeah, it sounds more logical. any body ever log on this unlock process?