Bb5 unlocking procedure (How To Unlock a BB5 mobile using Cyclone)

[moulnisky]

Just as in the screenshot

BR

Alex

[ASHRIFF]

Originally Posted by moulnisky

First thing go in the post http://forum.gsmhosting.com/vbb/showthread.php?t=705358
and check if you have the last version of the software and of the firmware: if not just reinstall the suite and/or update the box.
How to move with cyclone working on BB5 mobiles
Connect the TX2 adapter to the box and the fbus cable to the TX2 adapter (The TX2 adapter is the yellow cable in bundle with the box)
Start always, once connected the mobile and started the module DCT4/WD2/BB5 reading the infos
If you can get the infos, OK; If you can't go in the tab BB5/Flash and click on check flashing bus (This will take the mobile in needed mode)
In the tab Common/Info click on read PM (This will give you a back-up of your full PM and will test if the connection of the Fbus cable is OK)
Go now in the tab BB5/security and Click on "create RPL from PHONE" (This will give you a plain RPL of the phone)
Now you have a complete back-up of your mobile
If you are going to do any job as downgrading or erase, better you click on "read certs". this will give you a complete back-up of all the mobile certificates.
Now have a check at your tools:
If you use the TMA cable standard (the one with the USB cable) go in the tab BB5/Flash and Thick where says "SKIP repower on BOOT"
If you are using TMA Evolution or you are working without any TMA "SKIP repower on BOOT" must be not thicked.
Go back in the BB5/security Tab.
SX4 bypass must be not thicked
Select which unlocking system you want use
a) PM308 recalculation or classic system
b) NCK calculation New method
c) NCK calculation Old methos
d) RPL system (needs at least a balance of 101 credits)

Method A : PM308 recalculation
Use this system only for the mobile which can't be unlocked with any other system or if in emergency you have a balance under 101.
If the mobile is an old SL1 Thick where says "skip read SP Info", for the SL2 leave it not thicked
This system is able to rebuild the simlock table (using skip sp read thicked) in the rap3gv3 phones
Click on unlock
Job Done
Method B and C - NCK calculation
Just be sure you have a good local mode and press on unlock. If the procedure hangs after the codes are calculated just input them manually via keyboard.
Job Done

Method D - RPL system
This method need a credits balance of at least 101. Using this system we can unlock the mobiles which can't be unlocked via NCK and rebuild the simlock in the mobiles with SP data error. This system won't repair the superdongle
Just click on unlock and the job is done. The RPL is saved in the storedfiles folder anc can be used again if needed on the same mobile

Note: On the rapido SL2 with HASH 9A28 use only the PM308 rebuild or the RPL system and the hash is a quite doggy

This is all

BR

Alex

Yes! No doubt the cyclone is good tool for nokia, but one thing I disappoint for this new update is the way in unlocking, for me COMPLICATED in choosing what method will going to use, their is a lot of BB5 phone and we can't specifically know what method will going to use in a certain phone.....

Why they don't do this tool as friendly use.... or direct unlock....

[badgerjum]

wHAT ARE THE ABOVE CABLES AND DO YOU HAVE PICTURES OF THESE, I NEED TO UNLOCK A 7373 AND HAVE CYCLONE BOX AND TX2 CABLE, AM I RIGHT THEN IF IM THINKING WHEN I UNLOCK IT, I DONT TICK THE BOX SKIP POWER ON BOOT, AS I DONT HAVE EITHER OF THE 2 CABLES, MANY THANKS

[mobileunlockers]

thanks MR alex for your super guide..i got a question here,which is a good method to unlock 5220 and similar to them..thanks

[moulnisky]

Originally Posted by mobileunlockers

thanks MR alex for your super guide..i got a question here,which is a good method to unlock 5220 and similar to them..thanks

NCK calculation new method is the suggested one..
You can use as well the Simlock RPL method

BR

Alex

[badgerjum]

Originally Posted by moulnisky

First thing go in the post http://forum.gsmhosting.com/vbb/showthread.php?t=705358
and check if you have the last version of the software and of the firmware: if not just reinstall the suite and/or update the box.
How to move with cyclone working on BB5 mobiles
Connect the TX2 adapter to the box and the fbus cable to the TX2 adapter (The TX2 adapter is the yellow cable in bundle with the box)
Start always, once connected the mobile and started the module DCT4/WD2/BB5 reading the infos
If you can get the infos, OK; If you can't go in the tab BB5/Flash and click on check flashing bus (This will take the mobile in needed mode)
In the tab Common/Info click on read PM (This will give you a back-up of your full PM and will test if the connection of the Fbus cable is OK)
Go now in the tab BB5/security and Click on "create RPL from PHONE" (This will give you a plain RPL of the phone)
Now you have a complete back-up of your mobile
If you are going to do any job as downgrading or erase, better you click on "read certs". this will give you a complete back-up of all the mobile certificates.
Now have a check at your tools:
If you use the TMA cable standard (the one with the USB cable) go in the tab BB5/Flash and Thick where says "SKIP repower on BOOT"
If you are using TMA Evolution or you are working without any TMA "SKIP repower on BOOT" must be not thicked.
Go back in the BB5/security Tab.
SX4 bypass must be not thicked
Select which unlocking system you want use
a) PM308 recalculation or classic system
b) NCK calculation New method
c) NCK calculation Old methos
d) RPL system (needs at least a balance of 101 credits)

Method A : PM308 recalculation
Use this system only for the mobile which can't be unlocked with any other system or if in emergency you have a balance under 101.
If the mobile is an old SL1 Thick where says "skip read SP Info", for the SL2 leave it not thicked
This system is able to rebuild the simlock table (using skip sp read thicked) in the rap3gv3 phones
Click on unlock
Job Done
Method B and C - NCK calculation
Just be sure you have a good local mode and press on unlock. If the procedure hangs after the codes are calculated just input them manually via keyboard.
Job Done

Method D - RPL system
This method need a credits balance of at least 101. Using this system we can unlock the mobiles which can't be unlocked via NCK and rebuild the simlock in the mobiles with SP data error. This system won't repair the superdongle
Just click on unlock and the job is done. The RPL is saved in the storedfiles folder anc can be used again if needed on the same mobile

Note: On the rapido SL2 with HASH 9A28 use only the PM308 rebuild or the RPL system and the hash is a quite doggy

This is all

BR

Alex

The TMA cable is that the onewhich goes into the front of the box, and has a USB the other, need to know if i have to tick skip repower on boot box when unlocking 7373, many thanksAlso which unlocking system would i use a,b,c,,

[moulnisky]

Is a rap3gv3 (there is a list of the supported models in the sticky posts where all the models are divided for generation).
You cnaunlock it via PM308 recalculation or via NCK code new method.
It is not an heavy mobile as power usage.. shouldn't be necessary the TMA but only the TX2 adapter

BR

Alex

[badgerjum]

Originally Posted by moulnisky

Is a rap3gv3 (there is a list of the supported models in the sticky posts where all the models are divided for generation).
You cnaunlock it via PM308 recalculation or via NCK code new method.
It is not an heavy mobile as power usage.. shouldn't be necessary the TMA but only the TX2 adapter

BR

Alex

Sorry, for this, but do i tick, POWER ON REBOOT or not, i have tx2 adaptor, im not sure what a TMA is do you have picture, the other cable i have is the one with a usb at one end and the other end goes into the computer socket on the box,the same cable i use on my jaf box before, sorry for being a pain but i dont wont to muck up this phone, many thanks for your great help

[IBRAHIM BANGURA]

HELLO MR ALEX, what about this unsupported asics it pops up too much in my cyclone i was trying one 5030 rm 524 yesterday it read just to end up with unsupported asics

Originally Posted by moulnisky

NCK calculation new method is the suggested one..
You can use as well the Simlock RPL method

BR

Alex

[abheejeet]

very nice infi..........................

[digitalgsm_cora]

Please Mr. Alex change those methods of unlocking.... Is hard to use for many users...
Why u don't make just 1 button :direct unlock ?
Is a very good box for nokia but friendly interface is missing...
Please think how much succes jaf have for so many time because is easy to use

B.R.

[badgerjum]

Hi again moulnisky, tring to unlock 5200 using the cyclone box, using cable 1 of universal cables, and using tx2 cable, resister 5.1, also v.bat red lead, bsi green lead, and gnd colour black, says cant detect phone, checked connection of all cables, any idears my friend, many thanks

[moulnisky]

Carefull as in some cables is the green the GND and the black the BSI (SFBUS IV as sample)
Remember the GND is where in the battery is (-) and the BSI where on the battery there is the (o)
If the mobile switches on instead of going in local mode it means the mobile needs an higher BSI value
If the mobile goes in local mode but you can't see it check the Jig you are using.
On the UFC V2 as sample is the Jig n. 2 to use with the pin closest to the borde of pinouts not used (free) this jig is symetric so you can try positioning it in both the directions

BR

Alex

[badgerjum]

Originally Posted by moulnisky

Carefull as in some cables is the green the GND and the black the BSI (SFBUS IV as sample)
Remember the GND is where in the battery is (-) and the BSI where on the battery there is the (o)
If the mobile switches on instead of going in local mode it means the mobile needs an higher BSI value
If the mobile goes in local mode but you can't see it check the Jig you are using.
On the UFC V2 as sample is the Jig n. 2 to use with the pin closest to the borde of pinouts not used (free) this jig is symetric so you can try positioning it in both the directions

BR

Alex

hI AGAIN MATE, MANAGED TO UNLOCK 5200 OK, BUT NOW THE NAVAGATION BUTTON WONT WORK LEFT OR UP, THE UP WILL ONLY WORK IF IM SE;ECTING A NAME FROM MY LISTS, BUT WHEN I GO INTO LOOK AT PHONE SET UP, THEN TRY TO MOVE TOO SAY, WEB IT WONT MOVE UP OR LEFT PLEASE HELP AS THIS PHONE WILL BE SENT TO MY WIFES THAI DAUGHTER IN THAILAND WHEN FIXED, IF ANY ONE CAN HELP YOU CAN, ALL THE BEST AND MANY THANKS AS NORMAL.

[reydis]

Handling device: [Cyclone Team], [Cyclone Box]
Initializing box...
Box Firmware: Cyclone Nokia Application v01.21, (Feb 12 2010 23:32:03, gcc v4.3.2, RTOS V6.0.1), Type: Signed Production Application, (C) KarwosSoft 2010 wk6
Box Serial Number: C0002346
HW Revision: A, Suitable for: Production, Case: First Plastic Case, MCU Manufacture Time: 2009, wk27
Initializing security card...
Card Serial Number: D4000473
Card Firmware Revision: 0109
Card is activated
Box is activated
Started box selftests procedure
USB Voltage 5.10v PASSED
MCU Voltage 3.28v PASSED
Core Voltage 1.78v PASSED
VBAT Voltage 0.76v PASSED
VBAT Voltage 5.04v PASSED
Box VPP disabled
VPP Voltage 0.02v PASSED
Internal Box VPP Enabled
VPP Voltage 5.04v PASSED
Box VPP disabled
VPP Voltage 0.04v PASSED
External Box VPP Enabled
VPP Voltage 0.02v FAILED - IGNORED - Probably power supply is not connected
Box VPP disabled
All box selftests passed!
Super DCT4 Activation: TRUE
Initializing FBUS...
All initialized - Ready to work
MCU Version V 03.38
MCU Date 05-10-07
Product RM-276
Manufacturer (c) Nokia
IMEI 357694010597341
Mastercode 627527450
IMEI Spare 3A75960401953704
IMEI SV 3375960401953704F6000000
PPM Vp 03.38, 05-10-07, RM-276, (c) Nokia, L
CNT Content: Comcel Col v1, 25-09-07, RM-277, (c) Nokia,
PSN RHK573664
Product Code 0552989
Module Code 0203394
Basic Product Code 0515129
PSD 0000000000000000
LPSN 0
RETU 15
TAHVO 22
AHNE 30
HW 5055
RFIC 17141715
DSP MD_RAP_PB06_w41v25_01_ENO
LCD SEIKO
BT 06cc-P9.1
Simlock Server SIMLOCK SERVER
Simlock Key 7321010000000000
Simlock Profile 8000000000000000
Simlock Key Cnt 0
Simlock FBUS Cnt 0
Simlock [1,1] State: CLOSED Type: 7FFF6F07FFFFFFFF @ FC00 Data: 732101
BB5 Unlock Started...
MCU Version V 03.38
MCU Date 05-10-07
Product RM-276
Manufacturer (c) Nokia
IMEI 357694010597341
Mastercode 627527450
Simlock Server SIMLOCK SERVER
Simlock Key 7321010000000000
Simlock Profile 8000000000000000
Simlock Key Cnt 0
Simlock FBUS Cnt 0
Simlock [1,1] State: CLOSED Type: 7FFF6F07FFFFFFFF @ FC00 Data: 732101
Reading Security Block...
Security block OK and saved to "RM-276_357694010597341_22032010_075506 p.m..SecurityBlock.PM"
WARNING: "06C00116ECF101547CE8087B524DCEF6DEF1516C.C0002346 " Not Exists, Will read it...
Reading CYC file from phone...
Booting RAP...
CMT_SYSTEM_ASIC_ID: 000000010000022600010006010C192101003000
CMT_EM_ASIC_ID: 00000295
CMT_EM_ASIC_ID: 00000B22
CMT_PUBLIC_ID: 06C00116ECF101547CE8087B524DCEF6DEF1516C
CMT_ASIC_MODE_ID: 00
CMT_ROOT_KEY_HASH: BAF3A9C3DBFA8454937DB77F2B8852B1
CMT_BOOT_ROM_CRC: 273F6D55
CMT_SECURE_ROM_CRC: DFAAF68F
Prepare phone failed with message -> Not found required CMT Secondary Loader
Neither CYC file and exists or failed to read it from phone (Failed to Boot / Prepare Phone)
BB5 Unlock Failed -> Failed to obtain Phone Unique Data
BB5 Unlock Started...
MCU Version V 03.38
MCU Date 05-10-07
Product RM-276
Manufacturer (c) Nokia
IMEI 357694010597341
Mastercode 627527450
Simlock Server SIMLOCK SERVER
Simlock Key 7321010000000000
Simlock Profile 8000000000000000
Simlock Key Cnt 0
Simlock FBUS Cnt 0
Simlock [1,1] State: CLOSED Type: 7FFF6F07FFFFFFFF @ FC00 Data: 732101
Reading Security Block...
Security block OK and saved to "RM-276_357694010597341_22032010_075549 p.m..SecurityBlock.PM"
Determining PA Simlock...
Booting RAP...
CMT_SYSTEM_ASIC_ID: 000000010000022600010006010C192101003000
CMT_EM_ASIC_ID: 00000295
CMT_EM_ASIC_ID: 00000B22
CMT_PUBLIC_ID: 06C00116ECF101547CE8087B524DCEF6DEF1516C
CMT_ASIC_MODE_ID: 00
CMT_ROOT_KEY_HASH: BAF3A9C3DBFA8454937DB77F2B8852B1
CMT_BOOT_ROM_CRC: 273F6D55
CMT_SECURE_ROM_CRC: DFAAF68F
RAP3Gv3_2nd.fg, Type: 2nd Boot Loader, Rev: 0.9.11.1, Algo: BB5
Flashbus Write baud set to 1.0Mbits
Flashbus Read baud set to 98Kbits
Using OLD BB5 FLASHING PROTOCOL
FlashChip[0,CMT]: 0x00EC220C00008921, Samsung, NOR
FlashContent[0,CMT]: 00000000000000000000000000000000, NOR
FlashChip[0,CMT]: 0xFFFF000000000000, Unknown, MMC
Transmission Mode Requested: Single Line, 8 bit, Accepted: Single Line, 8 bit
RAP3Gv3_algo.fg, Type: Algorithm, Rev: 0.9.17.0, Algo: BB5 ALGORITHM
Flashbus Write baud set to 2.0Mbits
Transmission Mode Requested: Dual Line, 32 bit, Accepted: Dual Line, 32 bit
Box TX2 Data Pin set to: Service Pin 3
Box VPP disabled
Internal CMT Phone VPP Enabled
PAPUBKEYS Hash for CMT: A32E417B72C365977BB436843861AB6E35608542
Testing TX2 Line...
Prepare phone failed with message -> TX2 Test Failed! Check cable or yellow TX2 Adapter!
BB5 Unlock Failed -> Failed to Boot / Prepare Phone
BB5 Unlock Started...
MCU Version V 03.38
MCU Date 05-10-07
Product RM-276
Manufacturer (c) Nokia
IMEI 357694010597341
Mastercode 627527450
Simlock Server SIMLOCK SERVER
Simlock Key 7321010000000000
Simlock Profile 8000000000000000
Simlock Key Cnt 0
Simlock FBUS Cnt 0
Simlock [1,1] State: CLOSED Type: 7FFF6F07FFFFFFFF @ FC00 Data: 732101
Reading Security Block...
Security block OK and saved to "RM-276_357694010597341_22032010_075637 p.m..SecurityBlock.PM"
WARNING: "06C00116ECF101547CE8087B524DCEF6DEF1516C.C0002346 " Not Exists, Will read it...
Reading CYC file from phone...
Booting RAP...
CMT_SYSTEM_ASIC_ID: 000000010000022600010006010C192101003000
CMT_EM_ASIC_ID: 00000295
CMT_EM_ASIC_ID: 00000B22
CMT_PUBLIC_ID: 06C00116ECF101547CE8087B524DCEF6DEF1516C
CMT_ASIC_MODE_ID: 00
CMT_ROOT_KEY_HASH: BAF3A9C3DBFA8454937DB77F2B8852B1
CMT_BOOT_ROM_CRC: 273F6D55
CMT_SECURE_ROM_CRC: DFAAF68F
Prepare phone failed with message -> Not found required CMT Secondary Loader
Neither CYC file and exists or failed to read it from phone (Failed to Boot / Prepare Phone)
BB5 Unlock Failed -> Failed to obtain Phone Unique Data
BB5 Unlock Started...
MCU Version V 03.38
MCU Date 05-10-07
Product RM-276
Manufacturer (c) Nokia
IMEI 357694010597341
Mastercode 627527450
Simlock Server SIMLOCK SERVER
Simlock Key 7321010000000000
Simlock Profile 8000000000000000
Simlock Key Cnt 0
Simlock FBUS Cnt 0
Simlock [1,1] State: CLOSED Type: 7FFF6F07FFFFFFFF @ FC00 Data: 732101
Reading Security Block...
Security block OK and saved to "RM-276_357694010597341_22032010_075730 p.m..SecurityBlock.PM"
Determining PA Simlock...
Booting RAP...
CMT_SYSTEM_ASIC_ID: 000000010000022600010006010C192101003000
CMT_EM_ASIC_ID: 00000295
CMT_EM_ASIC_ID: 00000B22
CMT_PUBLIC_ID: 06C00116ECF101547CE8087B524DCEF6DEF1516C
CMT_ASIC_MODE_ID: 00
CMT_ROOT_KEY_HASH: BAF3A9C3DBFA8454937DB77F2B8852B1
CMT_BOOT_ROM_CRC: 273F6D55
CMT_SECURE_ROM_CRC: DFAAF68F
RAP3Gv3_2nd.fg, Type: 2nd Boot Loader, Rev: 0.9.11.1, Algo: BB5
Flashbus Write baud set to 1.0Mbits
Flashbus Read baud set to 98Kbits
Using OLD BB5 FLASHING PROTOCOL
FlashChip[0,CMT]: 0x00EC220C00008921, Samsung, NOR
FlashContent[0,CMT]: 00000000000000000000000000000000, NOR
FlashChip[0,CMT]: 0xFFFF000000000000, Unknown, MMC
Transmission Mode Requested: Single Line, 8 bit, Accepted: Single Line, 8 bit
RAP3Gv3_algo.fg, Type: Algorithm, Rev: 0.9.17.0, Algo: BB5 ALGORITHM
Flashbus Write baud set to 2.0Mbits
Transmission Mode Requested: Dual Line, 32 bit, Accepted: Dual Line, 32 bit
Box TX2 Data Pin set to: Service Pin 3
Box VPP disabled
Internal CMT Phone VPP Enabled
PAPUBKEYS Hash for CMT: A32E417B72C365977BB436843861AB6E35608542
Testing TX2 Line...
Prepare phone failed with message -> TX2 Test Failed! Check cable or yellow TX2 Adapter!
BB5 Unlock Failed -> Failed to Boot / Prepare Phone
Failed to read info -> Phone not detected