Motorola SLVR L7c: MetroPCS to VZW

[corys00]

Just succesfully activated a MetroPCS SLVR on to VZW. Will be working on making everything function. I'll post back with my progress.

[scannerman]

did verizon give you and grief trying to activate it?

[corys00]

Nope, I called CS with the ESN to just double check that it was able to be activated and it was cleared. I went home and logged onto to MyAccount and activated it.

[k.double]

i have a cricket l7c running on verizons network. i have been unable to get mms or dun (evdo or 1x) working. are you working on these? the /nvm folder is locked when i try to access it with qpst 2.7b215 or bitpim.

for mac users, i was able to get the l7c working with isync by adding the following code below the razor v3c in Metaclasses.plist file in the iSync.app bundle:

iSync.app : Contents : PlugIns : ApplePhoneConduit.syncdevice : Contents : PlugIns : PhoneModelsSync.phoneplugin : Contents : Resources : MetaClasses.plist

	<key>com.motorola.l7c</key>
	<dict>
		<key>Identification</key>
		<dict>
			<key>com.apple.gmi+gmm</key>
			<array>
				<string>"Motorola CE, Copyright 2004"+L7cm</string>
				<string>"Motorola CE, Copyright 2000"+L7cm</string>
				<string>"Motorola CE, Copyright 2004"+L7c</string>
				<string>"Motorola CE, Copyright 2000"+L7c</string>
				<string>Motorola CE, Copyright 2000+L7cm</string>
				<string>Motorola CE, Copyright 2000+L7c</string>
			</array>
		</dict>
		<key>InheritsFrom</key>
		<array>
			<string>com.motorola.usb-bt.0x22B8/0x4902</string>
		</array>
		<key>Services</key>
		<array>
			<dict>
				<key>ServiceName</key>
				<string>com.apple.model</string>
				<key>ServiceProperties</key>
				<dict>
					<key>ModelIcon</key>
					<string>MOTV8.tiff</string>
					<key>ModelName</key>
					<string>SLVR L7c</string>
				</dict>
			</dict>
			<dict>
				<key>ServiceName</key>
				<string>com.apple.synchro</string>
				<key>ServiceProperties</key>
				<dict>
					<key>stringEncoding</key>
					<string>UCS2</string>
				</dict>
			</dict>
		</array>
	</dict>

[corys00]

Yeah, the /nvm folder is locked, but after dinner I'm gonna work on seeing if I can find a workaround for that. So far I have Mobile Web working (which leads me to believe I can get GIN working as well). Just taking baby steps with it as there's no flash available to me right now (yes, I back up everything I work with)

[pmcafee]

Yeah, the /nvm folder is locked, but after dinner I'm gonna work on seeing if I can find a workaround for that. So far I have Mobile Web working (which leads me to believe I can get GIN working as well). Just taking baby steps with it as there's no flash available to me right now (yes, I back up everything I work with)

On the NVM thing you can follow Mark's monster2.htm guide. I assume that the SLVR is basically the same as the KRZR. If you can activate your old E815 and do the monster seems backup with Radiocomm you'll get the 01d2 seem which contains the HA and AAA keys needed for authentication, then you can do the service programming with QPST and enter the values for both of those keys. That's the only workaround I can think of seeing that we don't have SLVR firmware at this point in time.

[corys00]

I'm flashing my V3c back to VZW firmware to obtain the 01d1 seem (the only 01d seem monster.nvm backs up) and then load up QPST. I'll report back with my results.

[corys00]

I've done the seem edit to allow QPST to connect to the phone however With QPST 2.7 b215, I'm not having any luck with it. Is there a newer version of QPST?

[k.double]

what problems are you having with qpst? works fine for me using b215.

[null1281]

I've done the seem edit to allow QPST to connect to the phone however With QPST 2.7 b215, I'm not having any luck with it. Is there a newer version of QPST?

QPST 2.7 build 231 has been out for quite sometime.

[kernelpanic]

I'm flashing my V3c back to VZW firmware to obtain the 01d1 seem (the only 01d seem monster.nvm backs up) and then load up QPST. I'll report back with my results.

The 01d1 seem is simply <10 digit phone number>@vzw3g.com preceeded by the length of the string. It can be programmed from qpst or motorola PST.

The 01d2 seem contains the shared secrets. But I believe it may be handset specific on the server end. If you get the new handset to work off the values from your V3, post back because I haven't read/heard of that succeeding.

good luck,
kernelpanic

[kbman]

The shared secrets are absolutely hardware specific keys and must be backed up from your phone when it is fully functioning on the network.

01d2 is the critical seem as stated.

QPST 2.7 build 263 has also been released.

[k.double]

The shared secrets are absolutely hardware specific keys and must be backed up from your phone when it is fully functioning on the network.

starting with a cricket l7c activated on verizon how would one obtain these keys? no l7c vzw/unbranded flash is available yet (to my knowledge). i suppose i will have to wait for the vzw branded l7c to hit and that flash to be leaked? is it possible qpst 2.7 b263 will allow writing/reading of the /nvm files?

[pmcafee]

The shared secrets are absolutely hardware specific keys and must be backed up from your phone when it is fully functioning on the network.

01d2 is the critical seem as stated.

QPST 2.7 build 263 has also been released.

Interesting, I didn't know that. I thought the keys worked between different hardware. You learn something new everyday.

[kbman]

They change regularly when the network updates them. They are generated by an algorithm that uses the ESN and other hardware specific data to create a unique set of keys that absolutely identify that exact handset on the network.

It's the only way the authentication can be made secure for devices that require a dynamic Mobile IP assignment.