M7 unlocked but not

[huzsolt]

S-off, cid change is ok, but phone is still sim locked.

Config.dat seems ok, "imei checking pass" but phone asks for "sim IMSI unlock pin". It accepts 00000000 , restarts and asks again for the code. I tried with both unlocked - and locked option, still the same.





Reading information...
Using Fastboot mode...
Reading common information
(bootloader) version: 0.5
(bootloader) version-bootloader: 1.61.0000
(bootloader) version-baseband: 4T.35.3218.16
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 7.19.401.22
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: MB339W916582
(bootloader) imei: 3544360547xxxxx
(bootloader) meid: 00000000000000
(bootloader) product: m7_ul
(bootloader) platform: HBOOT-8064
(bootloader) modelid: PN0710000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 3765mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: dirty-0e2a13e5
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
Execution time is 64(ms)
all: Done!
8064 detected, reading IMEI2 ...
... (bootloader) [ERR] Command error !!!
Execution time is 20(ms)
OKAY
Reading secure flag information
... (bootloader) secure_flag: 0
Execution time is 20(ms)
OKAY
Reading CID information
... (bootloader) cid: 11111111
Execution time is 21(ms)
OKAY
Read information completed.

[huzsolt]

I found a thread on xda about similar problems, accepting the unlock code but the phone still remains locked. Ususally it happens after jtag resurrection, the mmc flash gets screwed... Have you met similar problems? I updated the firmware to the lates , 7.19 in ruu mode to fix the partition layouts, but still the same...

[xtc2clip]

IMSI unlock pin is not a sim lock, it's a kind of protection after emmc replace, etc. The solution for such phones is now being developed.

[huzsolt]

I thought so, mainly because I never have seen this code till now on htc, and some others reported that is releated to emmc protection . (If i get it correctly the emmc makes a cheksum to the modem (radio) and if the checksum doesn't mach it asks for the imsi ). Do you know any other methods to bypass that? Like writing a good dump to some partition with jtag? Or sould I just wait for your sollution?

[xtc2clip]

Originally Posted by huzsolt

I thought so, mainly because I never have seen this code till now on htc, and some others reported that is releated to emmc protection . (If i get it correctly the emmc makes a cheksum to the modem (radio) and if the checksum doesn't mach it asks for the imsi ). Do you know any other methods to bypass that? Like writing a good dump to some partition with jtag? Or sould I just wait for your sollution?

No, sorry, I truly don't know yet, as the solution is only being developed.
I don't even know yet what's the main cause (a checksum somewhere or something else). Sorry again.