Finding SIMLock algorithm from IMEIs and valid unlock codes

[iVMX]

Hi there.

I have a series of Huawei USB dongles (new models, NOT unlockable for free), and a set of unlock codes which are all valid (I already unlocked many of them).

I was wondering... considering that I have a decent amount of IMEI/LockCode pairs (20+), would it be possible to somehow find out the underlying algorithm that generates the unlock codes from the IMEIs?

How would I go about doing that? Is there any particular software that could "compare" the list of IMEIs with the list of unlock codes and look for patterns or something?

Just a thought of course. I might as well be completely wrong.

Thanks.

[fr3nsis]

Originally Posted by iVMX

Hi there.

I have a series of Huawei USB dongles (new models, NOT unlockable for free), and a set of unlock codes which are all valid (I already unlocked many of them).

I was wondering... considering that I have a decent amount of IMEI/LockCode pairs (20+), would it be possible to somehow find out the underlying algorithm that generates the unlock codes from the IMEIs?

How would I go about doing that? Is there any particular software that could "compare" the list of IMEIs with the list of unlock codes and look for patterns or something?

Just a thought of course. I might as well be completely wrong.

Thanks.

start to post them here
which modems are? firmwares customized or new models like e367,e353...?

[iVMX]

I'd love to, but unfortunately there are important security reasons that prevent me from posting the IMEIs here.

Of course I wouldn't mind sharing the algorithm if I found it, but I just can't share the specific IMEIs.

Oh, btw, they are a bunch of super sweet Vodafone K4605 Dual Carrier devices (Huawei E372).

If any of you can point me in the right direction to try and crack the codes myself I'll be glad to try. Otherwise... I think we'll have to wait :/

[latigido922]

Originally Posted by iVMX

I'd love to, but unfortunately there are important security reasons that prevent me from posting the IMEIs here.

Of course I wouldn't mind sharing the algorithm if I found it, but I just can't share the specific IMEIs.

Oh, btw, they are a bunch of super sweet Vodafone K4605 Dual Carrier devices (Huawei E372).

If any of you can point me in the right direction to try and crack the codes myself I'll be glad to try. Otherwise... I think we'll have to wait :/

All you need is: "hwideadatacard"

[Erdman]

"hwideadatacard" its new constant value for new model ? Any other change for algo ?

[fr3nsis]

Originally Posted by latigido922

All you need is: "hwideadatacard"

you are wrong my friend

imei 356793040863318 , *** code sniffed from dc-unlocker 16507861
hwidea... code 58058755

[iVMX]

I'm gonna need a little bit more help... I'm a noob when it comes to this stuff. Where should I be looking? Some software that reads stuff from the device... hex editor...?

Oh... did I mention the K4605 is dual carrier? 42mbps anyone?

[Spoochy]

Originally Posted by boucettay

U like try, research, maths, and perhaps No result
take this

---- nck ----------- imei ------------- nck --------- imei --------
688950000000 000000000000000 668950000010 000000000000010
488950000001 000000000000001 686950000100 000000000000100
288950000004 000000000000002 688750001000 000000000001000
088950000009 000000000000003 688930010000 000000000010000
888950000006 000000000000004 688958100000 000000000100000
688950000005 000000000000005 688951800000 000000001000000
488950000006 000000000000006 688960080000 000000010000000
288950000009 000000000000007 688050008000 000000100000000
088950000004 000000000000008 689950000800 000001000000000
888950000001 000000000000009 698950000080 000010000000000
688950000000 111111111111111 788950000008 000100000000000
022394444444 222222222222222 688950000000 001000000000000
800172222222 333333333333333 688950000000 010000000000000
022394444444 444444444444444 688950000000 100000000000000
688950000000 555555555555555 446536868686 101010101010101
688950000000 666666666666666 264718686868 010101010101010
022394444444 777777777777777 622954400440 110011001100110
800172222222 888888888888888 088390044004 001100110011001
022394444444 999999999999999 022350008888 111111100000000

WBR

Many more examples if you crawle this category..

[.:hack3r2k:.]

Originally Posted by fr3nsis

you are wrong my friend

imei 356793040863318 , *** code sniffed from dc-unlocker 16507861
hwidea... code 58058755

Why you dont dump the bloody nand by jtag, extract elf, load in ida and start digging. Much faster and usefull then loosing time arround

Br

[fr3nsis]

Originally Posted by .:hack3r2k:.

Why you dont dump the bloody nand by jtag, extract elf, load in ida and start digging. Much faster and usefull then loosing time arround

Br

modem wasn't mine and customer won't lost warranty
anyway i have extracted elf from firmware update , i'm reading it

[Erdman]

Flash code algo for new modem its the same ! Ani news for unlock code ?

[DarkManDZ]

Originally Posted by .:hack3r2k:.

Why you dont dump the bloody nand by jtag, extract elf, load in ida and start digging. Much faster and usefull then loosing time arround

Br

how to extract elf and with which tool???

[[Shadab_M]]

Originally Posted by DarkManDZ

how to extract elf and with which tool???

You can use RIFF.

Read DUMP and Load in Qualcomm Dump Analysis Tool (Addon in RIFF).

Br,
Shadab Ahmad

[TestBox2]

Originally Posted by fr3nsis

you are wrong my friend

imei 356793040863318 , *** code sniffed from dc-unlocker 16507861
hwidea... code 58058755

All simple :-)


// old-modems calc nck algo
Function h_nck(imei: string; password: string='hwe620datacard'):string;
var
digest : TMD5DigestX;
nck: dword;
_hash:string;
Revers:LongWord;
begin

TMD5Digest(digest):=md5stringa(password);
For Revers:=4 To 11 Do imei:=imei + LowerCase(IntToHex(Digest.v[Revers],2));
TMD5Digest(digest):=md5stringa(imei);

SetLength(_hash,32); BinToHex(@Digest,@_hash[1],16);
form1.memo1.Lines.add('Hash code: '+LowerCase(_hash));

For Revers:=0 To 3 Do Nck:=(Nck SHL 8) OR (Digest.v[Revers] XOR
Digest.v[Revers+4] XOR Digest.v[Revers+12] XOR Digest.v[Revers+8]);
Nck:=(Nck AND $1FFFFFF) OR $2000000; result:=(inttostr(Nck));

end;

[dzunlocker]

Originally Posted by DarkManDZ

how to extract elf and with which tool???

Hi
For playing with J-tag dump you can use "revskills", other softwares...Ort dump analyser etc ... you can also extract it manually.

hints : Hex editor + the Partition Table + '.ELF' magic
...

Regards