GSM-Forum - T-Mobile / Metro PCS unlock app MOD

GSM-Forum (https://forum.gsmhosting.com/vbb/)

- GSM Programming & Reverse Engineering (https://forum.gsmhosting.com/vbb/f83/)

- - T-Mobile / Metro PCS unlock app MOD (https://forum.gsmhosting.com/vbb/f83/t-mobile-metro-pcs-unlock-app-mod-2077400/)

Quote:

Originally Posted by iamimei (Post 12623956)

I already done for s7 tmobile app. but only work for s7. I already know the flow chart of the tmobile app for s7

So you managed to unlock s7? If so could you share how you did it? I can't seem to decompile the app to java and recompile because somethings get corrupt.

Bump....this method needs to be figured out. Since 2015, it is surprising no one has been able to find a way to crack the unlock app.

I have a T-Mo LG V20 and struggling for last 2 months to get it unlocked. 3rd party unlocking price is more than the phone itself. Can somebody help??

Me toi i have LG T-Mobile v 20 needed unlock

I don't know if somebody tried this before....but Since the device app checks the imei, is it possible to put a good imei of an unlocked phone, into another phone, try to unlock it using device app, if it becomes permanently unlocked, can you then change the imei again? and will the phone stay unlocked?

Pretty much was described here: https://forum.xda-developers.com/v20...nlock-t3821051
here are some updated about the device algo:

Device send 2 requests to t-mobile server
1. First request includes IMEI (signed by certificate)
2 Second request includes IMSI

if change imei by using any MITM tools it wont work as this will brake the signature. I used Frida to inject new imei into the unlock app request on the fly.
____
/ _ | Frida 12.1.1 - A world-class dynamic instrumentation toolkit
| (_| |
> _ | Commands:
/_/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at http://www.frida.re/docs/home/
Spawned `com.tmobile.simlock`. Resuming main thread!
[Samsung SM-G386T::com.tmobile.simlock]-> hook start...
Called - deviceID()
3528290656XXXXX

and the reply is "Server not responding. Please try again later"

The send request to server send IMSI only. And I am able to hook it using Frida. But this wont work as the unlock eligibility results or device flags got during the 1st server request.

Can you pm me so we can talk more about this topic please?

Here is the tmo v20 h918 unlock app that was linked in post #11 If I understand this google mess correctly this new link should work. gdrive /file/d/0B5Lqys5p5m_YWDJ3S3hJeHY0d28/view?usp=sharing&resourcekey=0-UU0gjP75hMWlj2CbLAqW3g can't post proper links... but you should figure it out easily enough