N900 User Code Read - How To

[Dzirt]

Here is some steps for do it :
If Device ask code on start - Flash with SW 10 - ONLY RootFs
Link on sample video - RootFs flash only N900
Ok, after we not have user code request.


Power Off device, press Connect/Info, Connect phone while holding U button.
Select in RD tab - Enable RD mode. Press Set. Press Reboot.

Press and hold "U" button and insert cable! (Ignore if phone Connected)
Waiting for NOLO...
Connect in NOLO mode Ok!

Phone Info : 
Type : RX-51 , HWRev : 2204
NOLO : 01/0E/14
SWVer: RX-51_2009SE_21.2011.38-1_PR_MR0
Device mode : Production mode

Read info Ok

Enable R&D mode...
Device state : R&D mode

Reboot request sent
Wait until phone power up
Done

Power On phone.
Go to Menu - Console

Enter -

sudo gainroot

After rootshell will be enabled do next :

echo root:$(grep -A 13 lock_code /dev/mtd1|tail -1): > /home/user/MyDocs/lock

Connect phone in Mass Storage mode.
Go to device root folder - you will see file "lock"
Copy it to PC.
Install John the ripper software from here - John win
Unpack it to desired folder.
Go to \john179w2\john179\run\
Copy to this folder file lock
Copy to this folder this bat file and settings file from here - BB5tool support

Run code_maemo.bat

Wait till finish - you will have your code in log
or you can find it in john.pot (open via notepad).

Reflash phone if needed to latest version.
Reset RD flags (if flashing with eMMC - need after reset RD flags - reconnect phone via Connect/info and press Reset All. Reboot )

All done!
All process take 2-3 minutes for all moves in this instruction.

P.S.:
Part of instruction - Downgrade, code request disable, r&d activate without any worries/internet acess and other things was done by Us.
Part of instruction of code retrieve was taken on maemo.org