Getting Non-Verizon Monsters working: The only thing consistent is inconsistency

[Mark_Venture]

Well, after reading every post in all of the threads about the various Non-Verizon monsters released recently...

Alltel V3C -> http://www.howardforums.com/showthread.php?t=1064653
Alltel K1M -> http://www.howardforums.com/showthread.php?t=1069181
Alltel V3M -> http://www.howardforums.com/showthread.php?t=1072371
MetroPCS V3C -> http://www.howardforums.com/showthread.php?t=1067164

and trying the different processes and proceedures to get everything working on Verizon's network (MMS, GIN, WAP, Vcast, etc...) with my V3C.... and fully documenting everything as I went....

I have come to the conclusion... the only thing consistent is the inconsistency...

As most of you know, I wrote up the steps I used converting my V3Cpp to Alltel... (slightly different than the Wiki) and it worked for me. I've done it several times in a row without a problem. I ran, and re-ran the process using VZW 1.15.04 -> Alltel 4.06 upgrade, Vzw 1.15.04 -> Alltel 4.06 Monster, and even VZW 1.15.04 -> Alltel 4.06 Upgrade -> Alltel 4.06 Monster... and it worked for me, but it doesn't work for MANY OTHERS

I ran through that same process again yesterday... The first time it didn't work at all!!! The 2nd time... everything works, only this time, I have to force the phone to 1x.. (before it also worked in EV mode...)

Many have just used the steps in the Alltel V3C wiki to varied success...

DanPFW submitted the steps he used to get the Alltel K1M monster going so I added it to my pages... Again, some can get it working, but others can not, or need to do additional steps.

No matter which process gets used, some are experiencing corruption of data services that are severe enough where only a call to VZW Customer Service can fix... But others don't.

For fun, I decided to try out DanPFW's K1M steps on my V3Cpp using the Alltle V3C MONSTER... just to see how it worked... First run... all was fine, exept for Seem 01d1... It contained 9995551212@alltel.net starting at offset 0002, rather than 9995551212@vzw3g.com... The value of Offset 01 was 15(h)... so I changed the value for offset 01 to 14(h), and changed the alltel.net to vzw3g.com using P2kSeem, wrote to phone... restarted... and everything checked out and worked just fine with the phone forced to 1x (like Dan's guide said..)...

Feeling good... I decided to re-flash the monster and try that process again to make sure its repeatable... This time 01d1 seem was set fine, but no matter what I did, seems 2979 and 2977 stay populated with the Alltel strings rather than the Verizon strings....

Luckily we have the newly leaked VERIZON Monsters for the V3M and K1M… for people who have troubles and want to “turn back” to the STOCK Verizon Firmware…. But I haven’t see the Verizon V3C monster leaked yet … However, the Verizon V3C can be reverted to stock Verizon firmware by flashing with the Verizon V3M Monster, then the Verizon 1.15.02 Superflash, followed by the Verizon 1.15.04 “Obex Enabled” flash… (Note: doing a master reset/master clear after each flash is suggested.)

So for those considering trying these Monster Flashes, please don't expect this to be an "easy" conversion. And you do have a safety net of the Verizon Monsters.

I know there are a few forum members who continue still doing research, working on hunches, theories, and possible explanations and fixes for this behind the scenes, giving input where they can... And I applaud them...

JLBRIGHTBILL, KBMAN and GOLDMEMBR continue to assist whenever/where ever possible. As well as discuss and research... And again, I thank them and appreciate all of their efforts!!

[GaryWojo]

Excellent post Mark, I too would like to thank all those who have helped in making the flash process a possibility. I know it takes a lot of time and effort to help all of us newbies out there, and I appreciate that you guys are willing to answer questions too. Keep up the good work guys.

[kbman]

Thanks to you too Mark!

I just can't stand not knowing how the stuff works...it's entirely selfish motivation.

[videogamerx]

Well said! I had been thinking along those lines. This has been extremely frustrating. It seems to be consistently not working for me .

[high technology]

I'd like to add my thanks to all here -- I haven't gotten the k1m yet, but I've done numerous flashes and seem edits to my v710 and E815 thanks to those of you on this site. Like kbman and Mark, I have a little bit of a selfish curiousity (no red bars!), but mostly I have an intellectual curiousity about how things work!

In my mind the inconsistency issue we are having has to be software, not hardware. While there might be different revisions of the hardware, minor differences should not generally affect flashing and firmware (they may be for example, minor physical changes in the components, such as the keypad). The root cause of this seems to me to be that we collectively have a lack of understanding of what things do and how they work. Or, that perhaps when explaining things we inadvertantly leave out steps that make a difference (when to reboot, when to do a master clear and master reset, etc.).

As an aside, I recently picked up a used V220 GSM phone for international traveling, and clearly the process of flashing and seem editing that phone is much more straightforward. I think some of the complexity we face on the CDMA side has a little to do with the adaptation of the Motorola p2k GSM architechture to CDMA, as well as many fewer of us trying to understand how everything works. Although I do think on the GSM end there is still some confusion as to the various states of SIM "unlocking" -- I unlocked it with a tool that did the trick and let me use various other SIMs, yet PST still reported it as being locked! I then edited another SEEM and "factory unlocked" it, which PST now reports as unlocked.

Perhaps one of the behind the scenes things we don't fully know about CDMA is whether the monster flashes truly replace everything on the phone, or if certain things aren't updated if they already exist. That might explain why some people get things to work, and some don't. One thing I wonder is whether we have a tool that can completely erase the flash blocks, leaving just what we need to reflash the phone (the bootloader?). I have limited knowledge of QPST -- does this program have such a tool?

In theory we are all trying to use the same phone specific file, and in the case of the k1m, I don't think there were multiple versions of the Verizon firmware. This leads me to believe that some differences may be related to extra steps (such as reboots or master clears) or specific tool differences (flashing and/or seem editing tools). The need for some people to call Verizon has me a bit perplexed -- I am not sure how something on the phone could have tripped something up on Verizon's system or why Verizon's system would need to push something to the phone.

[kbman]

The A-key is what gets pushed to the phone and is the primary element of the authentication encryption on the phone.

[jsnkir]

looks like we need a utility to back up the A-key

[hachu]

Is the A-key you're referring to the thing that is in the QPST Service Programming : MobileIP config as "AAA Shared Secret"? Cuz if we backup cdma_sec off the phone, we keep it.

Check this out:
http://www.howardforums.com/showthread.php?t=1072665

Now the question is, is it the same for every phone? Cuz that'd make life a bit easier.

The A-key is what gets pushed to the phone and is the primary element of the authentication encryption on the phone.

[ian1001]

i am a noob to flashing but heres what i found out. i flashed from vzw to alt 4.06 monster. my data fixes didnt work and got the same error message. i called up cs(still had 4.06 monster) and they reset my data. ironicly everything except mms worked perfectly. because i text alot i flashed back to verizon and got the exact same error as i did on my alt flashed phone. called cs again and they reset my data. it may not work for everyone but after all data fixes and you ger a"(554)" message call cs to reset your data. it worked for me

[jlbrightbill]

I'm the kind of person that doesn't want their account flagged for making too many calls to CS, so as I've posted other places, swap the active line on your account with another EV phone and it fixes data.

[jlbrightbill]

Is the A-key you're referring to the thing that is in the QPST Service Programming : MobileIP config as "AAA Shared Secret"? Cuz if we backup cdma_sec off the phone, we keep it.

Check this out:
http://www.howardforums.com/showthread.php?t=1072665

Now the question is, is it the same for every phone? Cuz that'd make life a bit easier.

There's a bit of a problem here though, from what the post over on the Sprint forum says, the key locations in cdma_sec are different based on the profile. The VZW cdma_sec only has 1 profile, my MIP fix results in 2 profiles. So we'd have to get the values from location 1 and input them into location 2, or something similar.

[hachu]

Can you link me to your MIP fix that results in 2 profiles since I haven't read it, and therefore don't know what the problem is that you're talking about?

What I was thinking was that since vzw phones just have one profile, we can download the cdma_sec before the flash, and then read locations:
0x992 profile 0 HA a-key (Shared Secret)
0x9a3 profile 0 AAA a-key (Shared Secret)

This is profile 0's keys (the first profile is 0 in QPST, but 1 in PST; likewise, the 2nd profile is 1 in QPST, 2 in PST) We simply copy/paste them back in as hex and commit the changes back to the phone when we're in trouble.

If you create a 2nd profile and commit those keys in. As long as you remember to set the active profile to the 2nd one, you should be fine as well. (however I haven't tested this myself, so I don't know if those firmwares actually obey the selection)

There's a bit of a problem here though, from what the post over on the Sprint forum says, the key locations in cdma_sec are different based on the profile. The VZW cdma_sec only has 1 profile, my MIP fix results in 2 profiles. So we'd have to get the values from location 1 and input them into location 2, or something similar.

[mountainman1]

I'm the kind of person that doesn't want their account flagged for making too many calls to CS, so as I've posted other places, swap the active line on your account with another EV phone and it fixes data.

How do I swap my active line? I do have 2 V3m phones on my account so I think it will work. Do I log onto my Verizon account, goto activate a new phone, use existing phone and just swap ESN numbers for my accounts active telephone number? Is there something else I need to do to the phone after swapping ESNs to make the change work?

Thanks

[jlbrightbill]

Can you link me to your MIP fix that results in 2 profiles since I haven't read it, and therefore don't know what the problem is that you're talking about?

What I was thinking was that since vzw phones just have one profile, we can download the cdma_sec before the flash, and then read locations:
0x992 profile 0 HA a-key (Shared Secret)
0x9a3 profile 0 AAA a-key (Shared Secret)

This is profile 0's keys (the first profile is 0 in QPST, but 1 in PST; likewise, the 2nd profile is 1 in QPST, 2 in PST) We simply copy/paste them back in as hex and commit the changes back to the phone when we're in trouble.

If you create a 2nd profile and commit those keys in. As long as you remember to set the active profile to the 2nd one, you should be fine as well. (however I haven't tested this myself, so I don't know if those firmwares actually obey the selection)

That should work, it would just take a little more effort because of the horrific trouble everybody is having in getting 01d1 rec 1 to write.

http://www.howardforums.com/showpost...&postcount=303

[kbman]

I successfully used QPST to write the old A-key from a saved cdma_sec file to my Alltel flashed phone.

It worked!

It wrote the new values into the cdma-sec file and didn't change any of the other seems.

I haven't activated the phone to test it yet but this is a very interesting development.