C25/C28 PhoneID calculation - GSM-Forum

papajoe · 12-06-2002, 17:14

Does anybody know how to get phone id from dead C25 v61?

I found out that the algorithm for encryption of the IMEI is very similar to the one used in x35 series.

There are some differences of course, for example eelite block 1 is used instead of eelite block 76 together with block 5009 to encrypt the IMEI, but my overall impression is that it is pretty the same algo.

The seeds used in calculation are 79 91 73 FD 15 5F B1 95 and the calculation itself is exactly as in x35 series (everybody that have read the sources from Maxim should know what I'm talking about :-).

The problem is how to get the phone id from the phone?
It has different boot modes and boots in service mode, but BFB command 05 23 doesn't work :-(

Any ideas ?

Sergey[Power User] · 12-08-2002, 02:47

You probably have to use your own bootloader...
Some bootcode and PhoneID reading related stuff can be requested via my e-mail...

papajoe · 12-09-2002, 16:48

I was right about the algo - it is really the same, just seeds are different :-)

I decoded the IMEI from the bin file floating around (c28 v61 good flash.bin) for example and the result is 4492484121627203 :-)

BTW: The algo for encoding block 5008 also seems to be the same as in x35 series as well.

@Sergey: Did you receive my private email?

papajoe · 12-11-2002, 13:53

After several days of hard work (disassembling the firmware) I managed to repair and unlock C28 v61 :-)
And used the phone itself to calculate the security blocks and unlock itself !!!
Finally I can return this phone to its owner totally repaired and unlocked :-)))
Regards to all!

gsmsalers · 01-02-2003, 15:12

Hi.
Which software or tool you used for disassembling?
Thanks

**Winner58** · 02-10-2004, 17:05

moved from GSM Programming

12-06-2002, 17:14	#1 (permalink)
papajoe Junior Member Join Date: Jan 2002 Location: n/a Posts: 23 Member: 8446 Status: Offline Thanks: 0 Thanked 0 Times in 0 Posts	C25/C28 PhoneID calculation Does anybody know how to get phone id from dead C25 v61? I found out that the algorithm for encryption of the IMEI is very similar to the one used in x35 series. There are some differences of course, for example eelite block 1 is used instead of eelite block 76 together with block 5009 to encrypt the IMEI, but my overall impression is that it is pretty the same algo. The seeds used in calculation are 79 91 73 FD 15 5F B1 95 and the calculation itself is exactly as in x35 series (everybody that have read the sources from Maxim should know what I'm talking about :-). The problem is how to get the phone id from the phone? It has different boot modes and boots in service mode, but BFB command 05 23 doesn't work :-( Any ideas ?

12-11-2002, 13:53	#4 (permalink)
papajoe Junior Member Join Date: Jan 2002 Location: n/a Posts: 23 Member: 8446 Status: Offline Thanks: 0 Thanked 0 Times in 0 Posts	C28 v.61 repaired :-) After several days of hard work (disassembling the firmware) I managed to repair and unlock C28 v61 :-) And used the phone itself to calculate the security blocks and unlock itself !!! Finally I can return this phone to its owner totally repaired and unlocked :-))) Regards to all!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
thread	Thread Starter	Forum	Replies	Last Post
C25/C28 repair and unlock solution	wazl	x1x to x45/x50	21	06-12-2001 23:32
C25/C28 v61 repair.	qido	x1x to x45/x50	45	04-25-2001 19:01
i have unlock for c25/c28/s25 all vir.	iceman1	x1x to x45/x50	12	04-06-2001 22:28
search link-Siemens C25/C28 Ver.61 Service Software Ver. 2.5	Baza	GSM Mobile Links	2	04-05-2001 20:04
andromeda C25/C28 Ver.61 S-Software Ver. 2.5	Baza	x1x to x45/x50	5	03-27-2001 23:29

12-08-2002, 02:47	#2 (permalink)
Sergey[Power User] Freak Poster Join Date: Oct 2001 Location: [internet] Posts: 104 Member: 6877 Status: Offline Thanks: 0 Thanked 0 Times in 0 Posts	You probably have to use your own bootloader... Some bootcode and PhoneID reading related stuff can be requested via my e-mail...

12-09-2002, 16:48	#3 (permalink)
papajoe Junior Member Join Date: Jan 2002 Location: n/a Posts: 23 Member: 8446 Status: Offline Thanks: 0 Thanked 0 Times in 0 Posts	I was right about the algo - it is really the same, just seeds are different :-) I decoded the IMEI from the bin file floating around (c28 v61 good flash.bin) for example and the result is 4492484121627203 :-) BTW: The algo for encoding block 5008 also seems to be the same as in x35 series as well. @Sergey: Did you receive my private email?

01-02-2003, 15:12	#5 (permalink)
gsmsalers No Life Poster Join Date: Apr 2002 Location: Flash Age: 33 Posts: 1,949 Member: 11208 Status: Offline Thanks: 1 Thanked 11 Times in 10 Posts	Hi. Which software or tool you used for disassembling? Thanks

02-10-2004, 17:05	#6 (permalink)
Winner58 Administrator Join Date: May 1999 Location: Wien/Austria Age: 54 Posts: 12,687 Member: 5 Status: Offline Thanks: 86 Thanked 1,634 Times in 487 Posts	moved from GSM Programming