GSM-Forum - How SL3 Unlock Codes are Calculated?

Page 1 of 3

Show 50 post(s) from this thread on one page

GSM-Forum (https://forum.gsmhosting.com/vbb/)

- GSM Programming & Reverse Engineering (https://forum.gsmhosting.com/vbb/f83/)

- - How SL3 Unlock Codes are Calculated? (https://forum.gsmhosting.com/vbb/f83/how-sl3-unlock-codes-calculated-1079689/)

[Shadab_M]

08-24-2010 15:56

How SL3 Unlock Codes are Calculated?

Hi!

I am just curious to know how SL3 Unlock Code calculation works.

As in some boxes there is option to submit request by imei only.

So the question is:
> What data is needed to calculate unlock code?
> Why unlock code calculation takes too much time?

In short, if somebody can tell us the procedure involved in code calculation.

Br,
Shadab Ahmad

malikawan

08-24-2010 17:53

As my knowledge code calculated by bruteforce so why they need too much time.

aniskhatri

08-24-2010 18:51

i think some special algorithm hide in every rap id and imei...........thts depend on time to be taken

fr3nsis

08-24-2010 19:16

Brute force SHA-1 of Truncated 15 digit-code + RND + IMEI until getting
a match from the decrypted hash entries in PM 120.

original post of x-shadow
http://forum.gsmhosting.com/vbb/f609...0/#post6159636

Haltec

08-24-2010 19:23

Quote:

Originally Posted by fr3nsis (Post 6249803)

I forgot that post was in sub-forum where it shoud be.

(Spent last 20 mins looking for it.)

BR

Haltec

Haltec

08-24-2010 20:34

And what truncated mean in this context?

Is it "Delphi" Trunc ?

As discarding evriting behind floating point, or...?

(ah, long time ago was that Turbo Pascal)

Why RND? (not Random..., I presume?)

BR

Haltec

angel25dz

08-24-2010 21:34

can someone explain more this Truncated 15 digit-code +RND ??

truncate you mean this ?

http://folders.pictures-upload.com/2...46gyshk9b7.png

dualtrace

08-24-2010 22:41

And this is what BPH had posted about RND value:

Quote:

The keyspace is so large because Nokia have decided to use a random number
in the calculation. This number is in the range of 0 - 1000 at the current SL3
implementation.

The phone has no clue about this number, when you enter valid code into the
phone, the HW will try to bruteforce this RND value and check if enter code is
valid for any of the possible RND values.

Well off course this is my interpretation of the security, like many times before
i could be wrong in my analysis, so any of the 'great teams' that offer 'first
in the worlds solutions' for Nokia right now can prove me wrong and offer
unlock in seconds.

Br,

dualtrace

[Shadab_M]

08-25-2010 02:15

Quote:

Originally Posted by fr3nsis (Post 6249803)

How they can match with hash in PM 120 as they take only IMEI from us?

Br,
Shadab Ahmad

..::AppleLinks::..

08-25-2010 05:12

i think they are manually Generating the Unlock codes from Phone IMEI ,so why it took too much time for Generate an unlock codes for a single phone.

uqbah

08-25-2010 08:02

Quote:

Originally Posted by shadab_a4u (Post 6250577)

How they can match with hash in PM 120 as they take only IMEI from us?

Br,
Shadab Ahmad

as i know all boxes must have 120 along with imei to calculate unlock code..
for time with ordinary or lower speed or less in numbers u have data processing units it must take long time to finish jobs..
as said above nokia use random numbers so they have to bruteforce the data for greater numbers of times to get exact match..

correct me if am wrong..:)

..::Angel::..

08-25-2010 09:19

Quote:

Originally Posted by shadab_a4u (Post 6250577)

How they can match with hash in PM 120 as they take only IMEI from us?

Br,
Shadab Ahmad

Hi,

All tool gets PM120 also with imei. Because SHA-1 sign is in PM120,2(decrypted hash entries i think so..) ;) and as well calculated code are stored in PM120,3

And they also modify loaders "RAPIDOv11" old hack :) In rapu phones Nokia must have fixed this hack but still some 'great teams' are able to exploit that :D

BUT there are some new rapido single asic phones with (hash 479C), i am thought Nokia have fixed all bugs in it and it has high security..! There should be other method to unlock this phone instead bruteforce :-) or I could be wrong.

BR

[Shadab_M]

08-25-2010 09:59

Does unlock code depends on MCC+MNC?

OR any other data which it may depend on?

Br,
Shadab Ahmad

..::Angel::..

08-25-2010 10:24

Quote:

Originally Posted by shadab_a4u (Post 6251889)

Does unlock code depends on MCC+MNC?

OR any other data which it may depend on?

Br,
Shadab Ahmad

Hi,

I think no. It does not depend on MCC, MNC! They generates level7 codes which removes all restriction in phone. So, no matter which level phone is locked to. If any phone does not accept level7 code or phone is not locked to appropriate level then in this case is not possible to unlock phone with generated level7 code. - Telcel Maxico phones :)

BR

[Shadab_M]

08-26-2010 07:01

Quote:

Originally Posted by fr3nsis (Post 6249803)

Brute force SHA-1 of Truncated 15 digit-code + RND + IMEI until getting
a match from the decrypted hash entries in PM 120.

original post of x-shadow
http://forum.gsmhosting.com/vbb/f609...0/#post6159636

Bro, can you explain this?

Does this mean:
> Need to make every possible 15 digit code.
> Use Random number from 0-1000.
> After adding both (dont know if it is simple addition), add IMEI.
> Now compare SHA-1 of this value to the value stored in PM120-2

Am I right? or I need more mind power to understand it? :D

Br,
Shadab Ahmad

Haltec

08-26-2010 14:50

And can someone tell what that ASCII is !!!

Quote:

Originally Posted by geohot (Post 5713093)

@german_gsm_team Because the iPhone jailbreaks and unlocks go directly to the end users. DCT4 stuff would just go to unlockers.

AND OMG I DONT BELIEVE I MISSED THIS

Code:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 01 42 8A 2F 98 D7 28 AE 22 3D DA

B6 DF FC 72 73 92 F7 1C B6 00 00 00 CB E7 2D A1

69 B4 99 42 E8 BB 59 87 CD FE 73 07 F5 16 26 FF

Cube it. "SHA" placeholder is ASCII.

So even if you can fully decrypt PM120, you'll still won't know the code beacouse it is multiplied with 0-1000 range integer? hmpf....

All of guys involving in this (won't name count them here - bcos don't wan't to accidentally forgot anyone) doing really cool stuff behind our GUI unlock button.

But how (and how) much closer DM3 get...

(by speed reported, it seems that they doesn't use BF at all)

@shadab_a4u - looks that way....

BR

Haltec

josedavido

08-26-2010 15:55

Still a mistery Mr. Shadab.

i guess this work is more simple it seems, but without a little of light from programmers, will be hard for us.

..::Angel::..

08-26-2010 15:55

Quote:

Originally Posted by Haltec (Post 6257502)

And can someone tell what that ASCII is !!!

So even if you can fully decrypt PM120, you'll still won't know the code beacouse it is multiplied with 0-1000 range integer? hmpf....

All of guys involving in this (won't name count them here - bcos don't wan't to accidentally forgot anyone) doing really cool stuff behind our GUI unlock button.

But how (and how) much closer DM3 get...

(by speed reported, it seems that they doesn't use BF at all)

@shadab_a4u - looks that way....

BR

Haltec

Hi,

Before few days ago i checked UB SL3 unlock average at their web and it was 5 mins only. So, i think DM3 also uses bruteforce or if DM3 does not use bruteforce then i would say UB has somehow connection with DM3 team :D

BR

JHUN PANABO

08-26-2010 16:13

Quote:

Originally Posted by ..::Angel::.. (Post 6257723)

maybe they connected, that's why mxkey untill now, they don't had the
solution,co's they can't afford the service...

Haltec

08-26-2010 16:20

Isn't DM3 is about 5-10 sec per phone ? - about same, as standalone rsa dct4 unlock....

Don't know if they (DM3) unlock 479C...

And I saw pictures of Griffin "Plant" on other forum. Serious job.

Would be great to see some pics from other teams too...

So in production of SL3 codes - nokia multiplied every produced code with 0-1000 and let ASIC to do the math.?

Good trick. Have to admit.

Maybe DM3 have way to force phone to accept their PM120 an then just enter respective code?

BR

Haltec

dualtrace

08-26-2010 16:22

Hi,

[120]
2=6AA06D79590AD984B3A89BF148C4F4C7359E675DD7D8F
835CEA93C8DBDFE489D10B3AECB108BFE14067A9A413865
92865801F796BD355B60EC9DEBAB610CF91955E33B226FD4
B0611FE410253693B308763461031F607FCF7630C8305CAA
ABA031D909A6B1C7E41BFA3DEFEA11F0E93D7D0AE16A15E
10FBCCB11DEAD266470490100

On the above SL3 PM120,2 data sample, anyone who can guide locate the sha1 hash for LEVEL 7 unlock code?

Br,

dualtrace

..::Angel::..

08-26-2010 17:42

Quote:

Originally Posted by Haltec (Post 6257829)

Hi,

I believe that DM3 and all other team uses bruteforce to unlock SL3 phones. And they have invested alot of money in this project.

Btw, if DM3 force phone to accept their own PM120 then unlock result would be any other config key not as unlock by codes. They could also offer simlock repairs.

Well, future will tell what's method being used to unlock SL3 phone. At the moment, it seems DM3 also uses BF method..!

BR

GSM Parts

08-26-2010 17:58

Quote:

Originally Posted by ..::Angel::.. (Post 6258148)

In 10 seconds Bruteforce?
Not makeable i am sure !

Regards GSM Parts

angel25dz

08-26-2010 22:17

Quote:

Originally Posted by dualtrace (Post 6257836)

good question that's what we need to try :-)

dualtrace

08-27-2010 04:43

Hi,

Quote:

And can someone tell what that ASCII is !!!

This is what he mean by his post.

'6675636B206D61746800DEAD0067656F686F74FF : f*ck math....geohot.'

Br,

dualtrace

oOXTCOo

08-27-2010 10:10

Quote:

Originally Posted by dualtrace (Post 6257836)

to decrypt this block, some more data is needed then just the pm block ;)

angel25dz

08-27-2010 10:18

Quote:

Originally Posted by oOXTCOo (Post 6260425)

to decrypt this block, some more data is needed then just the pm block ;)

it's crypted with AES encryption ???

angel25dz

08-29-2010 00:08

Quote:

Originally Posted by angel25dz (Post 6260446)

it's crypted with AES encryption ???

It was stupid from me :(

there is no SHA1 Hash in PM120,2

[120]
2=6AA06D79590AD984B3A89BF148C4F4C7359E675DD7D8F
835CEA93C8DBDFE489D10B3AECB108BFE14067A9A413865
92865801F796BD355B60EC9DEBAB610CF91955E33B226FD4
B0611FE410253693B308763461031F607FCF7630C8305CAA
ABA031D909A6B1C7E41BFA3DEFEA11F0E93D7D0AE16A15E
10FBCCB11DEAD266470490100

RSA-1024 bit signature = 128 bytes
fixed 02 bytes

That's what I think, if i'm wrong correct me :)

german gsm team

08-29-2010 02:27

Quote:

Originally Posted by ..::Angel::.. (Post 6251979)

IMHO codes are still calculated by SX-5 algo (with MCC, MNC and configuration key)

Telcel phones aren't unlockable due to byte 1 is set zo 1 in profile bits .

Therfore: No cable unlock, no keypad unlock - even with correct code.

Since simlock data (including profile bits) is RSA-signed there is no way to unlock without Nokia SX-4T card and online variant change.

dualtrace

08-29-2010 03:03

Quote:

there is no SHA1 Hash in PM120,2

[120]
2=6AA06D79590AD984B3A89BF148C4F4C7359E675DD7D8F
835CEA93C8DBDFE489D10B3AECB108BFE14067A9A413865
92865801F796BD355B60EC9DEBAB610CF91955E33B226FD4
B0611FE410253693B308763461031F607FCF7630C8305CAA
ABA031D909A6B1C7E41BFA3DEFEA11F0E93D7D0AE16A15E
10FBCCB11DEAD266470490100

RSA-1024 bit signature = 128 bytes
fixed 02 bytes

That's what I think, if i'm wrong correct me

So it is in PM120,1 which is 0xA0 bytes, maybe it is similar with
DCT4+ which is encrypted, but I dont think BB5 will use SAFER-64 :) .

Haltec

08-30-2010 09:31

Quote:

Originally Posted by german gsm team (Post 6266649)

Yes, but MCC, MNC, can be replaced with anything (even random number) in Algo - as long as they used same variable/value during locking process...

And how does this interfere IMEI+CODE+RND theory ?

Quote:

Originally Posted by karwos (Post 5816005)

Hi,
this should work on all nokia phones (dct3/4, bb5, wd2, infineon)
and most probably on units which were unlocked by code before (need chk that carefully).

So just enter code this format:

*pw+123451234512345+x#

(where X is lock level, and use * instead of #)

Do anybody knew this before ;) ? Credit goes to cyclone team.

This is more a curious trick than any update.
I will post some more "cool codes" later.

And one more thing - I might maybe, JUST MAYBE, ensure acess to sniff SX card communicaton with code calculation in qty of 100 choiced codes, would anyone be interested?

Will this even gain anything useful?

Of course card is MCC MNC dependant.

BR

Haltec

oOXTCOo

08-30-2010 11:08

Quote:

Originally Posted by Haltec (Post 6270670)

Yes, but MCC, MNC, can be replaced with anything (even random number) in Algo - as long as they used same variable/value during locking process...

And how does this interfere IMEI+CODE+RND theory ?

And one more thing - I might maybe, JUST MAYBE, ensure acess to sniff SX card communicaton with code calculation in qty of 100 choiced codes, would anyone be interested?

Will this even gain anything useful?

Of course card is MCC MNC dependant.

BR

Haltec

no the sniff will bring you nothing...
because you cant back calculate the results and make algo from this.

Haltec

08-30-2010 11:47

re:codes - probably not.

And I thought so, but wasn't sure (and I am still not) what exactely data are exchanged Winlock<<>>SX.

When I think about it a little - you are right - input is only IMEI + Lock level.

Side channel analysis, anyone? :)

BR

Haltec

p.s. Altough even that is not possible on new(est) security card generation.

german gsm team

08-30-2010 23:32

Quote:

Originally Posted by Haltec (Post 6271242)

p.s. Altough even that is not possible on new(est) security card generation.

But chip opening in a nanotech lab was and is still an option.

But makes no sense economically, yet.

Haltec

09-10-2010 22:51

Quote:

Originally Posted by Bph&co (Post 4995757)

Hi,

I can't be sure 100%, but i did some analysis on unlocked SL3 phones by DM3 and

to me it seems that he either have SX5 card connected to the server or access

to high level Salo account.

My original thought was that he is brute forcing the code, as it is no problem for

him to read the hashes from the phone. I also remembered our old conversation

that he gave me that idea for reading hashes and using powerful clusters to

bruteforce the code (back then was for dct4+).

But then i did simple tests on the data after DM3 unlock, results were:

1. Code entered by DM3 box is not the same as the Network will make, maybe

we can assume the SX5 SN is used as part of the calculation and the obvious

collision in the SL3 algo is not carelessness by Nokia but a feature to detect

who made the codes and probably blacklist SX5 codes in future firmware.

(if you remember dct4 codes, you will know what i am talking about)

2. The code DM3 box is calculating is not the first available one in the large

non-collision free keyspace, so bruteforce is maybe not what is used(Offcourse

he can just use different search algorithm)

Anyway all is assumptions because we don't have large enough data to

analyse.

Feel free to send me the last key of PM120 of unlocked phones by DM3 or

network codes, with large enough subset of data, all will be clear soon.

Regards, Alex

B-phreaks

Is this means that some SX5 card for designated operator (mcc_mnc) can be distinguished from other one by codes it generates, and any of codes generated will work the same ?

Let's say for example that Nokia produced 10 sx5 card for Orange UK - each of them can generate unlock codes trough winlock, and each code will be DIFFERENT but it will work. ?!

Uff... Guys aren't bad at all....

BR

Haltec

usernome

09-11-2010 14:43

If it's calculated by brute-force why can't we (some of us) do something like distributed.net ?

mustipusti

09-11-2010 15:26

Quote:

Originally Posted by usernome (Post 6319314)

If it's calculated by brute-force why can't we (some of us) do something like distributed.net ?

that wil cost too much money and the unlock price will be high for the customers.

luigivsf

09-11-2010 15:40

calculate codes for SL3 is possible, is just find the correct ASIC/Keycode

grab some calculated codes with their MNC+MCC and you will find answers

usernome

09-12-2010 04:20

Quote:

Originally Posted by mustipusti (Post 6319474)

that wil cost too much money and the unlock price will be high for the customers.

what money to cost ?
We will use our computers for calculation ...

mustipusti

09-12-2010 08:54

Quote:

Originally Posted by usernome (Post 6320761)

what money to cost ?
We will use our computers for calculation ...

I dont know but the price will be high;)( Thats why the teams are asking €30 to 100 for 1 unlock) With our computers it wil take months for 1 calculation.

usernome

09-13-2010 06:36

why do you think that they have more calculation power than all (or a lot) of us ?

[Shadab_M]

09-13-2010 08:02

May be, SL3 unlocking is not that complicated or doesnot need more powerfull systems.

Instead, solution providers are talking about it to keep some people away from this solution. So when we hear that it requires that much computing power and money, we will move on to research on BB5 booting. :D

Just an opinion...

Br,
Shadab Ahmad

uqbah

09-13-2010 14:39

no bro its computing is simple not so much complicated.(as much i know).
but it cost hight yes it is highly costed solution..
u need power full systems with data cards and electricity..

part of GT data centre for bruteforce sl3..

http://www.softmobile.net/test/DSC05383.JPG

http://www.softmobile.net/test/DSC05384.jpg

digitalgsm_cora

09-13-2010 20:21

Anyone think that there is no real solution for unlock sl3 phones?

What if those phones are unlocked only by imei in nokia service centers?

B.R.

moimoun

09-13-2010 21:26

Quote:

Originally Posted by uqbah (Post 6325644)

Thanks for sharing !:):eek: I was rather thinking about big super computer calculator !

paullovinicius

09-14-2010 00:33

Are they using CPU to calc codes???
I was thinking they are using GPU, like Genie Team.

usernome

09-14-2010 05:38

so what ?
All our computers will be much much powerful than that ...

oOXTCOo

09-14-2010 11:14

Quote:

Originally Posted by usernome (Post 6327567)

so what ?
All our computers will be much much powerful than that ...

shure is per GPU, you cant get same calculation power with the fastest CPU´s...

and per cluster they have minimum 2 grafikcards build it... some mainboards can old 4 (!!!) cards for paralell calculation...

so forget about your "normal" webservers...

angel25dz

09-14-2010 11:27

Quote:

Originally Posted by digitalgsm_cora (Post 6326742)

Anyone think that there is no real solution for unlock sl3 phones?

bruteforce is the unique solution available now, sure there is other ways to unlock SL3 but none got it at now !!

Quote:

Originally Posted by digitalgsm_cora (Post 6326742)

What if those phones are unlocked only by imei in nokia service centers?

B.R.

No way !!!

usernome

09-14-2010 13:32

Quote:

Originally Posted by oOXTCOo (Post 6328763)

"distributed.net" use our computers to calculate some keys .

Why can't we do that ?
1 milion computers are faster than 2000 GPU's ...

All times are GMT +1. The time now is 12:52.

Page 1 of 3

Show 50 post(s) from this thread on one page

Page generated in 0.38461 seconds with 6 queries

SEO by vBSEO