How to bruteforce old DCT-4++ phones like Nokia 1661?

[german gsm team]

I know that these phones stores SHA-1 values of unlock code, too - similar to SL3.

I know that these phone could be unlocked by RSA cube bug, but I would like to find out the real way.

I know how to patch phone to read out PM 21 to get the SHA-1 values.

But what range must be brute-forced in what way?

[dragosgsm]

Originally Posted by german gsm team

I know that these phones stores SHA-1 values of unlock code, too - similar to SL3.

I know that these phone could be unlocked by RSA cube bug, but I would like to find out the real way.

I know how to patch phone to read out PM 21 to get the SHA-1 values.

But what range must be brute-forced in what way?

why you wana bruteforce a 1661 when it can be unlocked easly by any tool???????????????

[Ionel]

Mabe he want to say 1616 1800 ...

[boucettay]

Originally Posted by dragosgsm

why you wana bruteforce a 1661 when it can be unlocked easly by any tool???????????????

Originally Posted by Ionel

Mabe he want to say 1616 1800 ...

German team Know what he say...
He don t want unlock phone, but know what part have to be BF...

perhaps is a way that will lead to fast unlock of 1616,1800 without BF

Good Luck

WBR