Relock

[wniz21]

Today i managed to relock my t720 by pst...
How?
This are commands that i can find out...

================================================== ==================
Do you want to relock to any network?If yes do this:
1step:
Read your NWSCP code with Victors soft, or with PST, and note this code...
2step:
Check locked to:
Send:rdelem
0x01
0x5b
0x00
0x01
0x00
0x00
0x00
0x03
Get:
0x00
0x12
0xF6
0x07
This means that my phone is locked to 216-70
If you want to lock to 216-30:
Send:stelem
0x01
0x5b
0x00
0x01
0x00
0x00
0x00
0x03
0x12 <-
0xF6 <-Here you can set prowider
0x03 <-
if you Get:0x00 it is OK
3step:
Next step to lock:
Send:Stelem
0x01
0xc3
0x00
0x01
0x00
0x00
0x00
0x07
0x00
0x00
0x00
0x08
0x08 <-This activate lock again
0x00
0x00
if you Get:0x00 it is OK
Now is your phone locked to 216-30, and it can just be opened with original NWSCP code...

================================================== ==============
And big thanks for Source, ho give me my NWSCP....



41=A
42=B
43=C
44=D
45=E
46=F
47=G
48=H
49=I
4a=J
4b=K
4c=L
4d=M
4e=N
4f=O
50=P
51=Q
52=R
53=S
54=T
55=U
56=V
57=W
58=X
59=Y
5a=Z
2e=.
5f=_

-------------------------------------------------------
Get Flash Vers.:
Form:Raw
0x41
0x54
0x56
0x0d
0x0a
0x41
0x54
0x2b
0x4d
0x4f
0x44
0x3d
0x31
0x0d
0x0a
0xaa
0xb0
0x30
0x00
0x00
0x0a
0x00
0x00
0x00
0x39
0x00
0x02
0x00
0x00
0xff
0xff
0x02
0x73
Get:
0xAA
0xB2
0x00
0x00
0x00
0x1D
0x80
0x00
0x80
0x39
0x00
0x15
0x00
0x00
0x14
0x40
0x28
0x23
0x29
0x54
0x37
0x32
0x30
0x5F
0x47
0x5F
0x30
0x35
0x2E
0x30
0x38
0x2E
0x30
0x30
0x52
Last 16 bits:This mean:T720_G_05.08.00R
------------------------------------------------------------
Check imei:
Send:
0x00
0x04
0x00
0x01
0x00
0x00
0x00
0x09
Get:
0x00
0x08
0x3A
0x05
0x09
0x04
0x27
0x17
0x72
0x06
This is reverse:350904072712762
------------------------------
Check soft Ver.:
Send: Version:
0xff
0xff
get:
0x14
0x40
0x28
0x23
0x29
0x54
0x37
0x32
0x30
0x5F
0x47
0x5F
0x30
0x35
0x2E
0x30
0x38
0x2E
0x30
0x30
0x52
This Mean:T720_G_05.08.00R
------------------------------
Phone tipe:
Send:
0x01
0x17
0x00
0x01
0x00
0x00
0x00
0x18
Get:
0x00
0x00
0x54
0x00
0x37
0x00
0x32
0x00
0x30
0x00
0x00
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
0xFF
This mean:T720
------------------------
Check user code:
0x00
0x74
0x00
0x01
0x00
0x00
0x00
0x09
Get:
0x00
0x00
0x36
0x00
0x35
0x00
0x34
0x00
0x33
0x00
This mean:6543
------------------------
Check Security code:
0x00
0x76
0x00
0x01
0x00
0x00
0x00
0x0e
Get:
0x00
0x00
0x39
0x00
0x38
0x00
0x37
0x00
0x36
0x00
0x35
0x00
0x34
0x00
0x00
This mean:987654
---------------------
Unknow:
Send:
0x01
0xc3
0x00
0x01
0x00
0x00
0x00
0x07
Get:
0x00
0x00
0x00
0x00
0x08
0x08
0x00
0x00

---------------------
Check locked to:
Send:
0x01
0x5b
0x00
0x01
0x00
0x00
0x00
0x03
Get:
0x00
0x12
0xF6
0x07
This is reverse
216-70
---------------------
Check flex version:
Send:
0x01
0x7f
0x00
0x01
0x00
0x00
0x00
0x28
Get:
0x00
0x53
0x45
0x34
0x33
0x30
0x380
0x41
0x58
0x58
0x52
0x34
0x30
0x35
0x33
0x20
0x2D
0x20
0x47
0x2E
0x30
0x2E
0x30
0x2E
0x54
0x2E
0x49
0x2E
0x30
0x2E
0x31
0x36
0x2E
0x36
0x48
0x2E
0x31
0x39
0x2E
0x48
0x2E
This means:SE4308AXXR4053-G.0.0.T.I.0.16.6H.19.H.
-----------------------------------------------------------------


This has with lock to do...
Send for NWSCP:
0x01

0x5d
0x00
0x01
0x00
0x00
0x00
0x04
get by locked:
0x08

By unlocked get:
0x00
0x22
0x08
0x95
0x41
This mean NWSCP is:22805914

Same:
Send for SSCP:
0x01
0x5c
0x00
0x01
0x00
0x00
0x00
0x04
get by locked:
0x08

Get by unlocked SSCP:
0x00
0x15
0x20
0x61
0x24
This mean SSCP is:51021642

This is about lock data, and here can you relock your phone:
Send:
0x01
0xc3
0x00
0x01
0x00
0x00
0x00
0x07
Get by locked:
0x00
0x00
0x00
0x00
0x08
0x08
0x00
0x00
Get by unlocked:
0x00
0x00
0x00
0x00
0x08
0x00
0x00
0x00


I hope i will get many-many unlock logs free from motorola code sellers when thely business goes better if people are dont afraid to lose waranty...

[CDE_PY]

Hello wniz21!
you have done a great job buddy.
Solution works 100% not only for the T720 but for the C33x series as well!
Any idea on how to activate the java games in the T720?

[sky178]

Read your NWSCP code with Victors soft, or with PST, and note this code...
how i can read it by PST?
if my phone lock, i can not lock it to another provider.
help

[desgrassia69]

I tried to read subsidy on my A835 (I unlocked it with unimoto, so I don't have my subsidy code) ... but it returns me hex values (i.e.
0x00
0x84
0x42
0x3F
0x2F
)

so since It converts to a 10-digits decimal, I can't use as my subsidy

I thought... maybe I can STore a subsidy gotten from ppl who unlocked with code

but PST always gives me error

then I tried reading all the hex location... with the command:

0x01
0x5C
0x00
0x01
0x00
0x00
0x00
0x00

and it returns me a long hex string

then I tried to do a STELEM of another string of the same length

PST does NOT give me any error, but when I go to read it, it's not been written, I still get the old one

any clues, ppl?

[pxer]

Thank you for the info wniz21, good job, although I do have a question on the subsidy code info (NWSCP). After the 0x00 I get 2 hex values and two sets of numbers. However if I extend the last value on the send (you have 0x04) to 0x06 I get 4 sets of numbers.
QuestionI have is this, do you have your subsidy code and does it match?

desgrassia69 - change the 0x5c to 0x5d and see what you get. (0x5c is for sscp) also change the last 0x04 to 0x06 and see if you get 4 sets of numbers.

pxer

[n2jtx]

Has anyone ever figured out the solution to getting the subsidy code when you receive hex numbers back? I have an unlocked V330 that I know the subsidy code for and I cannot reconcile that number with the hex number being returned by the RDELEM command at the beginning.

For reference, my code is 54907825 and the P2K command, using 5D, returns the following:

0x00
0xBE
0x7E
0x65
0x32
0x05
0xED


Using 5C I get:

0x00
0xDA
0xB9
0xFA
0xEE
0x74
0xB8

I have tried this on an unlocked V180 as well that I do not know the subsidy code to and I get back hex numbers as well.

[bih177]

Hello
wniz21

I need help!. I have the phone motorola T720G are sim lock. how unlock???
I have the PST victor GSM. You can explain do it

thansk

[n2jtx]

Originally Posted by n2jtx

Has anyone ever figured out the solution to getting the subsidy code when you receive hex numbers back? I have an unlocked V330 that I know the subsidy code for and I cannot reconcile that number with the hex number being returned by the RDELEM command at the beginning.
For reference, my code is 54907825 and the P2K command, using 5D, returns the following:
0x00
0xBE
0x7E
0x65
0x32
0x05
0xED
Using 5C I get:
0x00
0xDA
0xB9
0xFA
0xEE
0x74
0xB8
I have tried this on an unlocked V180 as well that I do not know the subsidy code to and I get back hex numbers as well.

I recently came across some additional information that might be useful for possible decoding. A subsidy code of "00000000" will be stored in SEEM 15D as "31462739". Checking into my own subsidy code of "54907825", which is stored as "BE7E6532", I discovered that the value is actually a scrambling of "45098752". Every two numbers in the subsidy code are swapped before being scrambled. Apparently the information posted at the top of this thread still applies, it just has an extra layer thrown on top of it now to make it difficult to read back.