How to enter Service Mode on a MW 3026 - GSM-Forum

chris922 · 06-07-2002, 17:54

Hi @All!

A new code has been found by Ths9, a good sagem specialist.

With the Ths9-Code you can reach Monitormode 3 at MW3026.
You can read the whole prom and reset unlock counter etc...

The Ths9-Code is

*226632623XY

X is firmware dependend, for DJ3,5C it is 5. For other firmwares you have to try it out...

Y is (the sum of the last 4 digits of the imei) modolo 10
If your IMEI is 35074735247892 - 1 then Y= (7+8+9+2)%10 = 6

Have much fun...
Chris

Foz · 06-07-2002, 19:59

hi Chris992,
i don t understand what is it but i m very interest.
send me e-mail at [email protected]

thx

Frank

Deppe92 · 06-07-2002, 21:36

Works great, even with DJ3,5D where fields 94,191,192,251,252,253 and so on are protected.

You can read an edit all prom fields, reset unlock-counter with setting field 94 to 0 and much more.

Lord · 06-08-2002, 02:10

Hi,
if you have DJ3,5D with hash table 28, go in Monitor mode 3,
read field 191 and 251 and send me IMEI and data from this fields.

Regards,
Lord

micmac · 06-08-2002, 03:24

hi

i have this send me the code plz :

210453678903 DJ3,5D: 040202 1533 ; IMEI: 350747351939)15

field 191 : 6E1682CF
field 251 : 6E1682CF
imei : 35074735193991-5

micmac · 06-08-2002, 03:31

sorry

with hash table 28

micmac · 06-08-2002, 03:55

hi Mr LORD

can you calculate me this code for my MW3026.

best regards.

Batgoy · 06-08-2002, 04:59

MW 3026 Load-A-Game
DJ3,5D: 040202 1533 ; IMEI: 35074735194684-5

field 0: 083a05473715498654
field 191 : 39d7e431
field 251 : 39d7e431

I not sure for hash table....

10x
Batgoy

latigido · 06-08-2002, 14:06

Code calculating require a little more data!

micmac · 06-08-2002, 17:26

hi

Sorry Mr latigido but Mr Lord says give me the imei , field 191, field 251, i will give the right code.

latigido · 06-08-2002, 18:41

My remark is friendly.
Phone ID is neceassary.
Good luck!

micmac · 06-08-2002, 19:18

hi

Sorry Mr Latigido but Mr Lord don't need the phone ID.
thx

Deppe92 · 06-08-2002, 19:22

@Lord

If you have hashtable 28 and I give you some fields (checksum fields) that are coded with phone ID and the fields like 191,192,251,252,253 is it possible to bruteforce phone ID???

razvanelgsm · 06-08-2002, 19:52

Hi to all

Of course is possibile,
from 00 00 00 00 00 00 to FF FF FF FF FF FF
and u will find the phone id... if u can wait for this

or u find a path for ID depends of version, than will be fast,
but i think the best way is to read id in boostrap mode

best
razvanelgsm

P.S. Sorry for my english, hope to understand what i mean

micmac · 06-08-2002, 21:16

hi

But where are you Mr Lord.

06-07-2002, 17:54	#1 (permalink)
chris922 No Life Poster Join Date: Mar 2002 Posts: 774 Member: 10175 Status: Offline Thanks Meter: 0	How to enter Service Mode on a MW 3026 Hi @All! A new code has been found by Ths9, a good sagem specialist. With the Ths9-Code you can reach Monitormode 3 at MW3026. You can read the whole prom and reset unlock counter etc... The Ths9-Code is *226632623XY X is firmware dependend, for DJ3,5C it is 5. For other firmwares you have to try it out... Y is (the sum of the last 4 digits of the imei) modolo 10 If your IMEI is 35074735247892 - 1 then Y= (7+8+9+2)%10 = 6 Have much fun... Chris

06-08-2002, 03:55	#7 (permalink)
micmac No Life Poster Join Date: Mar 2002 Location: tunis,tunisia Age: 48 Posts: 1,450 Member: 10396 Status: Offline Thanks Meter: 32	To LORD hi Mr LORD can you calculate me this code for my MW3026. best regards.

06-08-2002, 04:59	#8 (permalink)
Batgoy Freak Poster Join Date: Feb 2001 Location: Tazmania Posts: 270 Member: 3272 Status: Offline Thanks Meter: 1	Calculate please! MW 3026 Load-A-Game DJ3,5D: 040202 1533 ; IMEI: 35074735194684-5 field 0: 083a05473715498654 field 191 : 39d7e431 field 251 : 39d7e431 I not sure for hash table.... 10x Batgoy

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
how to enter download mode on benq-siemens ef81?	dexter_mn	NON Siemens Brand (ODM Phones)	1	11-13-2008 18:57
how to enter local mode for E90-1	mrphuc	Nokia Base Band 5 ( BB-5 )	1	04-02-2008 04:22
how to enter bootloader mode on IPAC 6365	Softway	HTC & PDA WM( With Touchscreen)	1	01-18-2008 10:40
How to enter TAT mode in Samsung Sysol??	agge	FuriouS II	4	08-22-2005 06:47
How to enter test mode in myX-5	patric	ARM9 BASED M62 / M62+	3	12-01-2002 00:11

06-07-2002, 19:59	#2 (permalink)
Foz Freak Poster Join Date: Jun 2002 Age: 45 Posts: 164 Member: 12622 Status: Offline Thanks Meter: 0	hi Chris992, i don t understand what is it but i m very interest. send me e-mail at [email protected] thx Frank

06-07-2002, 21:36	#3 (permalink)
Deppe92 Insane Poster Join Date: Mar 2002 Age: 44 Posts: 71 Member: 10127 Status: Offline Thanks Meter: 1	Works great, even with DJ3,5D where fields 94,191,192,251,252,253 and so on are protected. You can read an edit all prom fields, reset unlock-counter with setting field 94 to 0 and much more.

06-08-2002, 02:10	#4 (permalink)
Lord Insane Poster Join Date: Jan 2000 Posts: 74 Member: 869 Status: Offline Thanks Meter: 0	Hi, if you have DJ3,5D with hash table 28, go in Monitor mode 3, read field 191 and 251 and send me IMEI and data from this fields. Regards, Lord

06-08-2002, 03:24	#5 (permalink)
micmac No Life Poster Join Date: Mar 2002 Location: tunis,tunisia Age: 48 Posts: 1,450 Member: 10396 Status: Offline Thanks Meter: 32	hi i have this send me the code plz : 210453678903 DJ3,5D: 040202 1533 ; IMEI: 350747351939)15 field 191 : 6E1682CF field 251 : 6E1682CF imei : 35074735193991-5

06-08-2002, 03:31	#6 (permalink)
micmac No Life Poster Join Date: Mar 2002 Location: tunis,tunisia Age: 48 Posts: 1,450 Member: 10396 Status: Offline Thanks Meter: 32	sorry with hash table 28

06-08-2002, 14:06	#9 (permalink)
latigido No Life Poster Join Date: Feb 2002 Location: Europe Posts: 6,102 Member: 9544 Status: Offline Thanks Meter: 5,533	Code calculating require a little more data!

06-08-2002, 17:26	#10 (permalink)
micmac No Life Poster Join Date: Mar 2002 Location: tunis,tunisia Age: 48 Posts: 1,450 Member: 10396 Status: Offline Thanks Meter: 32	hi Sorry Mr latigido but Mr Lord says give me the imei , field 191, field 251, i will give the right code.

06-08-2002, 18:41	#11 (permalink)
latigido No Life Poster Join Date: Feb 2002 Location: Europe Posts: 6,102 Member: 9544 Status: Offline Thanks Meter: 5,533	My remark is friendly. Phone ID is neceassary. Good luck!

06-08-2002, 19:18	#12 (permalink)
micmac No Life Poster Join Date: Mar 2002 Location: tunis,tunisia Age: 48 Posts: 1,450 Member: 10396 Status: Offline Thanks Meter: 32	hi Sorry Mr Latigido but Mr Lord don't need the phone ID. thx

06-08-2002, 19:22	#13 (permalink)
Deppe92 Insane Poster Join Date: Mar 2002 Age: 44 Posts: 71 Member: 10127 Status: Offline Thanks Meter: 1	@Lord If you have hashtable 28 and I give you some fields (checksum fields) that are coded with phone ID and the fields like 191,192,251,252,253 is it possible to bruteforce phone ID???

06-08-2002, 19:52	#14 (permalink)
razvanelgsm Freak Poster Join Date: Sep 2001 Location: Cluj, Romania Age: 47 Posts: 204 Member: 6119 Status: Offline Thanks Meter: 0	Hi to all Of course is possibile, from 00 00 00 00 00 00 to FF FF FF FF FF FF and u will find the phone id... if u can wait for this or u find a path for ID depends of version, than will be fast, but i think the best way is to read id in boostrap mode best razvanelgsm P.S. Sorry for my english, hope to understand what i mean

06-08-2002, 21:16	#15 (permalink)
micmac No Life Poster Join Date: Mar 2002 Location: tunis,tunisia Age: 48 Posts: 1,450 Member: 10396 Status: Offline Thanks Meter: 32	hi But where are you Mr Lord.