How to make bruteforce file for unlock? [ Check STICKY Threads - Use SEARCH ]

[spritstiv]

Hi.

Ineed to have an 3720C unlocked.... i got the unlocker but he need to have an bruteforce file til unlock it....

but how do i make an bruteforce file?

[spritstiv]

and yes i have cyclone box

[florinbr]

BB5>simlock>read LBF
follow the instructions and you have a bf log sl3

[spritstiv]

Establishing Connection with Box in Main Mode...
Handling device: [Cyclone Team], [Cyclone Box], [Platform: Classic]
Initializing box...
Box Firmware: Cyclone Main Application v02.11, (Nov 10 2012 00:51:46, gcc v4.3.3, RTOS V6.0.1), Type: Signed Production Application, (C) KarwosSoft 2012
Hardware Platform: Cyclone Classic Flasher Interface (c) 2008,2009 KarwosLabs
Box Serial Number: C0002DB5
HW Revision: A, Suitable for: Production, Case: First Plastic Case, MCU Manufacture Time: 2009, wk32
Initializing security card...
Card Serial Number: DC0000F8
Card Firmware Revision: 0109
Card is activated
Box is activated
Started box selftests procedure
USB Voltage 4,86v PASSED
MCU Voltage 3,30v PASSED
Core Voltage 1,80v PASSED
VBAT Voltage 0,96v PASSED
VBAT Voltage 4,75v PASSED
Box VPP disabled
VPP Voltage 0,04v PASSED
Internal Box VPP Enabled
VPP Voltage 4,75v PASSED
Box VPP disabled
VPP Voltage 0,04v PASSED
External Box VPP Enabled
VPP Voltage 0,04v FAILED - IGNORED - Probably power supply is not connected
Box VPP disabled
All box selftests passed!
Super DCT4 Activation: TRUE
XGold/Blackberry Service Running, Counter: 100
Avaiable Physical Memory: 1023.1023MB
Avaiable Virtual Memory: 1.650GB
Avaiable Pagefile: 1023.1023MB
Initializing FBUS...
All initialized - Ready to work
Booting CMT...
CMT_SYSTEM_ASIC_ID: 000000010000022600010006030C192101033000
CMT_EM_ASIC_ID: 00000296
CMT_EM_ASIC_ID: 00000B22
CMT_PUBLIC_ID: 134000126C2C105680246A17E3D75506B9242B87
CMT_ASIC_MODE_ID: 00
CMT_ROOT_KEY_HASH: 9DDBFCFE6E73CED7D8C6268C8EB85723
CMT_BOOT_ROM_CRC: 273F6D55
CMT_SECURE_ROM_CRC: DFAAF68F
CMT Ready!
Searching for BootCode: DualLine 32Bit
RAP3Gv3_2nd.fg, Type: 2nd Boot Loader, Rev: 0.10.42.0, Algo: BB5
Flashbus Write baud set to 1.0Mbits
Flashbus Read baud set to 98Kbits
Using OLD BB5 FLASHING PROTOCOL
If software STUCK HERE with box TX LED lit, that means:
1. You have not attached yellow TX2 Adapter (IT IS REQUIRED FOR BB5 PHONES WHEN USING JAF/UFS CABLES!)
2. Your cable is not TX2 Enabled!
3. Transmission error occured, try again
In either cases, you need to reconnect your box from USB.
FlashChip[0,CMT]: 0x0089898200008A31, Intel, NOR
FlashContent[0,CMT]: 00000000000000000000000000000000, NOR
FlashChip[0,CMT]: 0xFFFF000000000000, Unknown, MMC
Transmission Mode Requested: Single Line, 8 bit, Accepted: Single Line, 8 bit
Searching for BootCode: DualLine 32Bit
FlashChip 0x00898982 (Intel), Size: 64MBytes, VPP: 9V
RAP3Gv3_algo.fg, Type: Algorithm, Rev: 0.10.40.0, Algo: BB5 ALGORITHM
Flashbus Write baud set to 2.0Mbits
Transmission Mode Requested: Dual Line, 32 bit, Accepted: Dual Line, 32 bit
Box TX2 Data Pin set to: Service Pin 3
Box VPP disabled
Internal CMT Phone VPP Enabled
PAPUBKEYS Hash for CMT: 649FB9FA3B26D5538A86100744A489436F78B693
APE Boot skipped on user request
Flashbus Write baud set to 5.0Mbits
Restarting MCU...
Reading SL3 LOG File...
MCU Version V 10.16
MCU Date 07-12-09
Product RM-518 (Nokia 3720 classic)
Manufacturer (c) Nokia
IMEI 351687050115517
Mastercode 5371723140
Analyzing Profile Bits...
Phone can be NCK unlocked using KEYPAD
Phone can be NCK unlocked using FBUS
15 Digits NCK Found
"134000126C2C105680246A17E3D75506B9242B87.C0002DB5 " Exists, That is good...
Success!

and the files i get is :


351687050115517.bcl
351687050115517.log
351687050115517.sha
351687050115517_ATI_32bit_oclHashCat.bat
351687050115517_ATI_64bit_oclHashCat.bat
351687050115517_NVIDIA_32bit_oclHashCat.bat
351687050115517_NVIDIA_64bit_oclHashCat.bat

is that correct?

[.:zuberber:.]

If you have SL3 server (Super PC) then calculate .sha file or send your .sha file to other
that can do the bruteforce calculation..