E71 unlock problem

[NiceLys]

i try to unlock 2 phones E71 but no SKey.
I used BSReader and have the hash+esn keys, but papuautils cannot calculate skey, tried with tp but no success. any idea to calculate this skey ?

[dagos]

Originally Posted by NiceLys

i try to unlock 2 phones E71 but no SKey.
I used BSReader and have the hash+esn keys, but papuautils cannot calculate skey, tried with tp but no success. any idea to calculate this skey ?

Hi,
I have somme questions:
-which version of papuautils you used?
-If you used BsReader midlet with papuautils, normarly needed to automatically write ESN and HASH inside (in the papuautils case).
-which firmware you haved inside in the phone?
dagos

[NiceLys]

tried with ver.38dEng, 77Eng and 111a197.
can u explain more how to write automatically ESN and HASH inside ?
thx in advance for your help

Originally Posted by dagos

Hi,
I have somme questions:
-which version of papuautils you used?
-If you used BsReader midlet with papuautils, normarly needed to automatically write ESN and HASH inside (in the papuautils case).
-which firmware you haved inside in the phone?
dagos

[dagos]

Originally Posted by NiceLys

tried with ver.38dEng, 77Eng and 111a197.
can u explain more how to write automatically ESN and HASH inside ?
thx in advance for your help

Hi (again),
I you know ESN, (readed directly from the phone), write in the papuautls case in the following order:
-ESN from the phone: A1B2-C3F4
-write in the papuautils: F4C3-B2A1

Instruction for unlocking used PapuaUtils

(Detailes provided by Hacktek)
my 1st ME75:advices and assistance needed

-USE DATA CABLE- with SiMoCo (or the other Phone Manager)
..and never disconect the cable!
- Copy Viper or bsReader(Viper.jar or bsReader.jar to phone in: "Data\Java\jam\Applications"
- start aplication (into phone) -» Data\Applications-»Viper (or bsReader)
- Confirm local conexion 'By Session'.
- Confirm acess aplication java to data cable.
-Wait few seconds (or minutes).
- wait for a 'beep' and the IMEI/ESN/HASH should in phone.
-dont touch nothing and run x65flasher-1072 (or the other X65 flasher version).
-click connect, so the 'keys' calculate starts. wait the calculate.
- start x65PapuaUtils and click button 'PX65V4' - program starts receiving imei/esn/hash from java aplication.

- Click "Calculate Skey and Bkey' and wait skey e a bkey to be calculated
- turn off the phone,
-USE UNLOCK CABLE
- GO 'ServiceMode'.
- click'Enter Skey to phone'.now all keys are saved
- Go'ServiceMode'.
-Enter Skey to phone', should appear 'FactoryMode'.
- Cick'Freia.log'. dont save the log, CANCEL. after that the prog ask if you want write blocks directly to phone. click Yes.
- Program write the blocks.

dagos

[NiceLys]

With BSReader i don't see where it asks to confirm local connexion "by session" ans so on, but with viper when press this connexion it gives connection failure.

Originally Posted by dagos

Hi (again),
I you know ESN, (readed directly from the phone), write in the papuautls case in the following order:
-ESN from the phone: A1B2-C3F4
-write in the papuautils: F4C3-B2A1

Instruction for unlocking used PapuaUtils

(Detailes provided by Hacktek)
my 1st ME75:advices and assistance needed

-USE DATA CABLE- with SiMoCo (or the other Phone Manager)
..and never disconect the cable!
- Copy Viper or bsReader(Viper.jar or bsReader.jar to phone in: "Data\Java\jam\Applications"
- start aplication (into phone) -» Data\Applications-»Viper (or bsReader)
- Confirm local conexion 'By Session'.
- Confirm acess aplication java to data cable.
-Wait few seconds (or minutes).
- wait for a 'beep' and the IMEI/ESN/HASH should in phone.
-dont touch nothing and run x65flasher-1072 (or the other X65 flasher version).
-click connect, so the 'keys' calculate starts. wait the calculate.
- start x65PapuaUtils and click button 'PX65V4' - program starts receiving imei/esn/hash from java aplication.

- Click "Calculate Skey and Bkey' and wait skey e a bkey to be calculated
- turn off the phone,
dagos

[NiceLys]

After asking to "Allow java application to acess accessory?" when press yes i receive this message : Error Java.lang.NoClassDefFoundError:com/siemens/mp/io/File
what to do ?

[dagos]

Originally Posted by NiceLys

After asking to "Allow java application to acess accessory?" when press yes i receive this message : Error Java.lang.NoClassDefFoundError:com/siemens/mp/io/File
what to do ?

...in this case write on the paper HASH and ESN, write manually in the phone; for ESN write in the phone D4C3-B2A1 (phone display in the following order ESN: A1B2-C3D4) and click to calculate SKEY.
dagos

[NiceLys]

i wrote it like this, but it gives "keys not founds" when i press to calculate SKEY+BOOTKEY.
and the version of this is 37.

Originally Posted by dagos

...in this case write on the paper HASH and ESN, write manually in the phone; for ESN write in the phone D4C3-B2A1 (phone display in the following order ESN: A1B2-C3D4) and click to calculate SKEY.
dagos

[dagos]

Originally Posted by NiceLys

i wrote it like this, but it gives "keys not founds" when i press to calculate SKEY+BOOTKEY.
and the version of this is 37.

...this is the normal. You used high version....
You need to use testpoint procedure:
-go to the "Flash" tab.
-chose Pause.
-chose 76,5008,5009,5077 in recalculate keys.
-Do the Job!
you must detach tp when ask "pause 2 seconde".

..and after few secconds your phone is unlocked.
Br,
dagos

[NiceLys]

thanks, can i give the correct pinout for unlock serial cable please ?

Originally Posted by dagos

...this is the normal. You used high version....
You need to use testpoint procedure:
-go to the "Flash" tab.
-chose Pause.
-chose 76,5008,5009,5077 in recalculate keys.
-Do the Job!
you must detach tp when ask "pause 2 seconde".

..and after few secconds your phone is unlocked.
Br,
dagos

[dagos]

Originally Posted by NiceLys

thanks, can i give the correct pinout for unlock serial cable please ?

...see bellow:
Pin1: + Power charger or Autoignition
Pin2:GND
Pin3:TX
Pin4:RX

dagos

[NiceLys]

this pinout is not correct for unlock serial cable, can u check it, please ,
GND is at pin5.

Originally Posted by dagos

...see bellow:
Pin1: + Power charger or Autoignition
Pin2:GND
Pin3:TX
Pin4:RX

dagos

[dagos]

Originally Posted by NiceLys

this pinout is not correct for unlock serial cable, can u check it, please ,
GND is at pin5.

...sorry it is true (E71 use Nano Lumberg connector):

Pin1: RTS (D+ for USB DCA140 cable)
Pin2: CTS (D- for USB DCA140 cable)
Pin3: TX
Pin4: RX
Pin5: GND
Pin6: DCD
Pin7: Ignition (power charger)
Pin8: GND Microphone
Pin9: MICEA
Pin10: Stereo2_Out
Pin11: Phantom_Buff_Out
Pin12: Stereo2_Out

dagos

[khunglong0401]

E71 RM-346 unlock ok thanks zulea hiiiii