HOW TO: LG VX9900 enV on Cricket with All Data Features Working including Brew!!!

[berry_lthird]

Here you go! I must say that overall it is not too difficult a phone to hack--it's just all the little nit-picky details that you have to be aware of. I've done the procedure several times now and I'm sure I have the procedure down correctly. Maybe as more members here start to get an enV we'll get a pretty good troubleshooting team like we have for the UTStarcom xv6700.

The phone is pretty, and sports some really sleek features, but it all comes at a very heavy price due to Verizon's ******* treatment of their flagship handsets. So it's entirely up to you whether it's worth all the trouble or not.

With that, all I can say to you is.....GOOD LUCK!

Tips on Purchasing your enV:

--You can get contract-free Verizon phones from any Verizon affiliate that sells Verizon handsets and accessories. Be advised that you will be paying the FULL RETAIL PRICE for the phone.

--I hear that prices have come down on eBay for the phone. You may also want to check Craig's List.

What to Expect when you Flash your enV over to Cricket:

Verizon's notoriously proprietary interface has thus far proven to be IMPOSSIBLE to crack. This is a Verizon phone, folks. Their name and branding will be all over the place--outside, and in. You will see it in almost all the menus and there is no getting away from it.

Worse, he music player on the phone will probably no longer work for you. I will continue to search for a solution, but be prepared to consider it a loss. The only other way you can listen to your music is to put your songs in the My Sounds folder. No playlists, shuttle controls, or anything. There is also a "hidden" media player in the phone's programming settings (which does NOT allow stereo over Bluetooth, BTW), but we'll get into this later.

The proprietary Verizon music player is the most shameful aspect of the phone, which is otherwise an awesome handset.

You WILL, however, be able to get WAP, MMS, and yes.....even Brew to work. You just have to live with the fact that they will all be crippled by Verizon's atrocious user interface.

--Step "0": "Pre-Flashing" your enV:

What you will need:

--Software: The latest BitPim or QPST to transfer files to and from your handset. BitPim is FREE at bitpim.org. QPST is licensed software that you will have to search for yourself (I used version 2.7 build 215). Either will do.

To edit the phone's WAP settings, you will need to use a hex editor. Any will do. I used Hex Workshop 4.2. It's freeware:

http://www.download.com/3000-2352-10...age&tag=button

You will also need a copy of LG Download 1.3.xx (Professional Version) and the proper VX9900 .DLL file and the modem drivers for your phone. Again, you will have to search on your own for this software as I have noticed threads closed and removed from Howard Forums that offered the tool. But many Rapidshare or Torrent sites should have it. And when you DO find it, it's a total ***** to set-up, as it requires you to run a hardware dongle emulator. Don't even bother asking me what that is if you are planning on proceeding with this hack! RTFM, Google, Wikipedia, etc. are your friends. If you can find it and get past the Hasp Emulator installation, consider it a right of passage to continue hacking this phone. If you can't, then just stop right here. Not to be rude, but this basically means that you are not up to the challenges ahead. Otherwise, maybe you should send these instructions to a pro and let them flash it for you.

And NO--I will REFUSE to respond to any Private Messages on the topic of installing LG Download. Sorry to be a prick about it, but I will respect your request more if you actually find the LG Download tool and get in installed properly. And don't be surprised if other members of this forum feel the same way I do about it. I have led you to the water, now it is up to you to actually drink it.

A good place to start your search for software tools is Mobile-Files.com:

http://www.howardforums.com

Here is a quick guide to setting-up LG Download for the VX8300, but it also works fine for the VX9900:

http://howardforums.com/showthread.php?t=981424

1: You need LGDownload, and the vx8300 dll.. search around on here, and Rapidshare, you should find them both. (I used version 1.3.6.3 of LGDownload)

2: Install the DLL and LGDownload.. reboot when prompted after installing LGDownload.

3: Open LGDownload, in the top right bar you will see a button labeled DLL next to a button labeled DLL with a check under it... first press the DLL with the Check Mark under it to enable user DLL selection.. then press the DLL button. Click the Tri Mode folder and select the VX8300 dll on the right (double click).

4: On the left in the Download Shortcut bar, click on NV Edit, and then click on NV Edit Start. It will prompt you for a code, it is 000000.

--Hardware: The phone itself, obviously. You will also need a data cable. You can purchase Verizon's "Music Essentials Kit" from just about any Verion store or affiliate. Be careful when purchasing the Music Essentials Kit--there are some versions compatible with the VX9900, but they are not all the same! My headset connects where the phone charger and data cable plug into the base of the unit and DOES NOT WORK WHATSOEVER--not eve for regular voice calls. So if you want a fully functional headset, will need the Music Essentials Kit with the standard 2.5" headset connector.

You can also use BlueTooth if your PC has it or a dongle/adapter. BlueTooth is not as fast as USB so things will take longer. Also, you have to worry about the caveats of properly setting-up your BlueTooth connection. There are many threads in the LG forums to explain how to do this.

If you want all of Verizon's goodies, such as V CAST media and Get It Now games and applications, your only chance is to activate your handset using Verizon's pay-as-you-go prepaid services. Visit their website for more details. Be warned, however, because Verizon will withhold the phone's ESN (MEID) in their system for at least SIX MONTHS after you de-activate (or haven't paid) your account. The only other possible way around this (that I know of) is to become a fully-authorized Verizon customer, and then cancel the account after about a month or so.

I did the former and didn't realize Verizon's prepay caveat, so I had to use a little tool called UniCDMA to change the phone's ESN (yes, ESN) and now I have two phones with the same phone number that ring at the same time! (I will not elaborate on how I did this as it may violate some of the rules of the forum. There are enough links here and on Google, so in that regard, you're on your own.)

The following thread discusses how you can back-up your Get It Now apps and games:

http://www.howardforums.com/showthread.php?t=1058608

I forgot the step where I was supposed to cancel my subscriptions, so they are gone for good. This method may very well work, but I highly doubt it. I tried uploading the Brew directly as per lizzul589's instructions to no avail. I even tried flashing my phone with the current VX9900 firmware which didn't work, either. So at this time I cannot find a solution to making the OEM music player (much less other applications) work. The phone is otherwise 90% usable without these features.

The good news is that Brew actually works! And you can actually browse Cricket's selection of Brew applications (a.k.a. "Cricket Clicks"). Furthermore, some of the downloads like games and ringtones are stored in the proper directories on the phone so that you can navigate to them even with Verizon's Frankenstein user interface. There is also a "secret" standalone Brew application launcher that I will go over later in my tutorial.

--You will need a copy of a recent Cricket PRL file, which you can get from HERE (thanks to Ziplock1):

http://www.howardforums.com/showpost...7&postcount=54

Don't be alarmed that the file has the extension .RLA instead of .PRL--it works just the same. If you want to, though, you can re-name the file extension to .PRL. It doesn't really make any difference as far as I can tell.

--Skill, patience, and a lot of nerve!: You will need a moderate to expert-level understanding of manipulating a phone's internal software. You should at least have flashed or hacked two or more handsets successfully before even attempting to hack your enV. You need to know things like how to set-up communication ports on you computer and a general understanding of what the differences between an MIN and MDN are. This is a daunting task to say the least and should NOT be attempted by you beginners and novices. If after my tutorial you are stuck or wind-up with a brick, then it's YOUR fault for not heeding my disclaimer. *said like Seinfeld's "Soup Nazi"* NO tech support forrrdddh you!

--Step 1: Activating the Phone to Cricket:

--Changing your ESN with Cricket: This part can be tricky. First, you will need the phone's ESN number. The easiest way to do this is to use BitPim. To get your phone's ESN, go to Edit and then select Phone Info. Easy. No mess, no hassle. And best of all, no need to use an MEID to ESN converter! The MEID number for your handset appears on the UPC label of the box. Here are a couple links to online MEID to ESN converters:

http://www.neolineas.com/pesn.yaws

http://www.humpa.com/vzw/meid_to_esn.php

--You will need to update the phone with a recent .PRL file: I find that the easiest way to do this is using LG Download, but you can use other tools if you are more familiar with them. You can also click the OK button while the phone is open on its side, then hit zero seven times to access the phones Service Programming menu. From there, you can go through the phone's settings step by step, entering the MID, MDN, etc. manually. I had no luck with this so I uploaded the .PRL manually using LG Download.

In LG Download, there are button icons down the left-hand side of the window. You will see one that reads "PRL Write". Locate the .PRL or .RLA file, select which NAM you want to write to, then click the bar that reads "PRL Write Start". You should then be able to do Cricket's OTASP by entering *228. (On a side note, I tried doing this using my regional code suffix, i.e. *228xx, but since the phone "thought" it was in roaming mode, I got Cricket's automated "this number is no longer in service" recording.)

If you are still hearing Verizon's OTASP menu, then you will need to go into the phone's internal SPT. Open the phone on its side and press the OK key, then type seven zeros. Make sure that your MID and MDN are set-up correctly, as these are not always the same! Also, check your Home SID number. I got mine to work by setting it to 0. If you have one handy, check these settings on a native Cricket handset to be sure.

You will know you have voice working when you dial *228 and get Cricket's OTASP automated prompt. Let your phone complete the OTASP, and you are done with this part of the procedure.

Congratulations--you are now able to use your Verizon-branded LG VX9900 enV on Cricket's UNLIMITED voice network!

The next steps are to get WAP, MMS, and Brew working, respectively.

--Step 2: WAP (a.k.a. "Cricket Mobile Web"):

The first thing to do is to make the WAP settings editable. You do this by hex-editing a file named "parmtable1.fil" in the phone's internal filesystem. Use the following instructions:

************************************************** ***************************
Make WAP Settings Editable
Source: http://howardforums.com/showthread.php?t=984149

This involves editing a file from your phone. But first you need to get the file off your phone and then make a backup copy and save it somewhere safe, like an email, or flash drive.

In Bitpim click on “View”, “View Filesystem”. Then click on “Filesystem” from the list on the left window.

Navigate to /OWS/paramtable1.fil Right click and copy it to your hard drive.


Download HexEdit
Make sure you've already made a backup copy of your paramtable1.fil file.

Open paramtable1.fil in HexEdit and change the 3rd byte from 00 to 20 and click File, Save As, but make sure you save it as the exact same file name.


[If the images are down please download the PDF at the bottom of this post]

Now open up Bitpim again.
Navigate back to /OWS/paramtable1.fil
Right click on the file and select “Overwrite”.
Now find the file that you just edited and overwrite the file on the phone.
Close Bitpim and disconnect the phone from the usb cable.


[If the images are down please download the PDF at the bottom of this post]

Now when you go into the service menu you can edit the wap proxy addresses.

Menu
Press 0, 000000 (six zeros)
Wap Setting
Proxy Address Setting & Proxy Port Edit both the primary and secondary settings.
************************************************** ***************************

The original thread can be found HERE:

http://www.howardforums.com/showthread.php?p=7995918

You can either enter your sites by entering them into the paramtable.fil while in the hex editor OR assuming you unlocked the phone's WAP settings, you can do this from the Services menu as explained above. To make your lives a little easier, I've taken the liberty to pre-configure a paramtable.fil file for you, which you can download at your own leisure attached at the end of this post.

*NEW AND IMPROVED! I've attached a new and improved paramtable1.fil at the end of this post. Links have been updated to include the mobile versions of various websites without the use of Google's proxy gateway. Enjoy!

I suggest you examine my file in the hex editor anyway: You may want to customize where all the links go to suit your own taste.

*NOTE: some of these links are "hard-baked" into Verizon's navigation system. For example email and chat from the Get It Now menu have their own respective links. Using Google as a proxy, you can edit these links to go virtually ANYWHERE you want to on Cricket's unlimited data network.

Once you are done editing/uploading the paramtable.fil file, the next thing you need to do is change the phone's setting using the LG Download NV Edit tool. In LG Download, launch NV Edit from the icons listed down the left column of the window. Upon launch, you will be asked to enter a code, which should be six zero's. (In actuality, I've never typed ANYTHING in that dialogue, and it all continues to work just fine for me!)

To get Cricket Mobile Web to work, you must first change the settings in NV Edit's Data, MIP Profile, and WAP tabs, respectively.

In the Data tab, you must change the MIP mode to SIP (for "Simple IP Only"). You must then change the SIP NAI, DUN NAI, and AN NAI to [email protected]. *NOTE that your MIN (an ID number assigned by your cellular provider) may actually differ from your MDN (your actual ten digit phone number). The SIP PASSWORD and the AN Password are both cricket. And the DATA_PKT_ORIG_STR should be #777 (see screenshot below):



Next, select the MIP Profile tab and change both the MIP NAI and DUN MIP NAI to [email protected]. Then change the MN_Authenticator settings to six 1's if it isn't already (see screenshot below):



DO NOT ATTEMPT THIS STEP ON LG DARE OR VOYAGER!!! YOU HAVE BEEN WARNED!!!

Finally, select the WAP tab and change both the Primary and Secondary Server URL's to wap.mycricket.com. Your User Name should be yourMIN ONLY, you DO NOT need the @mycricket.com part here! The Password is cricket, and the Homepage can be set to either http://wap.cricket.motricity.com for Cricket's "closed" home page or http://www.google.com/gwt/n for Google's proxy that allows you to browse anywhere you please! (See screenshot below):



When you are done with all these settings, click Write. When your phone resets, test your settings to see if you can connect.

If you can, you're golden! If not, try putting [email protected] explicitly as your User Name in the WAP tab. From my experience, the most important settings seem to be the MIP Profile, but I could be wrong. As more people activate the enV, there will be more opportunities to troubleshoot any individual problems you might have.

--Step 3: MMS:

Once you have confirmed that you have WAP fully working, the next step is to tackle the sending and receiving of MMS (a.ka. "Picture Messaging"). You will need to connect to your handset using the LG Download NV Edit utility. Once NV Edit is connected, select the MMS tab. For the MMSC Server Name, enter:

http://mms.mycricket.com

*NOTE: Unlike most MMS settings, you will NOT need to enter the /servlets/mms suffix to this URL!

The Address for Upload to Pix Place setting is OPTIONAL. I took these settings from a Motorola, and the enV seems like it tries to send, but I get an error that suggests using a ten digit phone number instead (?). If someone has any wisdom as to what settings should go here, I'm sure it will be warmly received.

Next, in the UAPro URL in User Agent settings, use the /servlets/mms suffix. The Delivery Ack setting is OPTIONAL. And finally, MMS Sending From Field Type set to MDN Only (refer to the screenshot below):



--Step 4: Brew:

WARNING: BREW WILL ERASE YOUR MEDIA PLAYER AND IM PROGRAMS!

Now that WAP and MMS are working, the final step is to get Cricket's Brew service called "Cricket Clicks". To access the phone's Brew settings, you will need LG Download's NV Edit tool. Once connected to the phone, go to the Brew tab. For the BREW ADS IP/URL setting, enter the following:

Leap-prod-vip.qualcomm.com,Leap-test-vip.qualcomm.com

*NOTE: Qualcomm is spelled with TWO mm's.

The next two settings are the Platform ID, which is 8074, and the Carrier ID, which is 82 (see the screenshot below):



To test your Brew settings, you will need to enter the Services menu. Click OK, then type-in seven zero's, then hit 9 to enter the Get It Now Setting menu. Hit the letter "G" on the keyboard and you will see the Brew services shopping cart (you may get a prompt first, but just click OK). If your Brew settings worked, your phone should connect to Cricket's downloads home page.

As a note: I've had my enV hacked for a few weeks now. I apologize; this tutorial would have came sooner, but I have been busy PLUS I've been trying to troubleshoot how to get the My Music media player back and fully functional again. No one on Howard Forums seems to know or be willing to help out on this (and I certainly didn't find very much love in the Verizon/LG forums). Thankfully, there was a lot of groundwork already laid from users before me.

Hopefully, once some of the Cricket gurus here and in other forums start using the enV, we may have a better chance of figuring-out how to get it working again!

If there are any type-o's or mistakes, please let me know and I will try to edit this post ASAP.

Cheers!

[berry_lthird]

I must stress that YOU WILL LOSE MOST OF YOUR VERIZON APPS when changing your BREW settings or ESN.

Again, if you are hacking a Verizon phone's BREW or ESN-it will effectively BREAK all of Verizon's proprietary apps!

This means that when you click the email button, NOTHING will happen. Same thing if you try to open the Instant Messaging application. You will get a NO APPLICATION error. And yes, this also means the Verizon MUSIC PLAYER.

Please DO NOT pm me or ask me how to fix this. I'm trying, but as of right now, the point is entirely MOOT.

Enjoy everything else about the phone, but consider the Verizon apps a loss.

If you can't deal with this reality, then you may as well forget my tutorial.

YOU HAVE BEEN WARNED!!!

[ahmedkamil]

i need motto l7 monister fole asap, anybody has it

[kokgo20]

does the LG 8600 work the same as 9900?
Thanks in advance.

[KyCpl]

berry - thanks for the tutorial, i've almost got it going.
My MMS screen in NV edit is different from the one in the tutorial. can you please advise??
whats the mms user agent profile supposed to be??





nevermind, i just blanked it out, now i'm getting mms....

[randomwit]

berry - thanks for the tutorial, i've almost got it going.
My MMS screen in NV edit is different from the one in the tutorial. can you please advise??
whats the mms user agent profile supposed to be??





nevermind, i just blanked it out, now i'm getting mms....

make the following changes to the settings listed below:

- MMS Upload URL = "111111"
- MMS User Agent Profile = "/servlets/mms"
- Send from Add = "MDN Only"

this will fix your mms

enjoy

[KyCpl]

I must stress that YOU WILL LOSE MOST OF YOUR VERIZON APPS when changing your BREW settings or ESN.

Again, if you are hacking a Verizon phone's BREW or ESN-it will effectively BREAK all of Verizon's proprietary apps!

This means that when you click the email button, NOTHING will happen. Same thing if you try to open the Instant Messaging application. You will get a NO APPLICATION error. And yes, this also means the Verizon MUSIC PLAYER.

Please DO NOT pm me or ask me how to fix this. I'm trying, but as of right now, the point is entirely MOOT.

Enjoy everything else about the phone, but consider the Verizon apps a loss.

If you can't deal with this reality, then you may as well forget my tutorial.

YOU HAVE BEEN WARNED!!!

so if i dont mess with the brew, will the apps work on cricket??

uhhhh NM, stoopid question......

[randomwit]

so if i dont mess with the brew, will the apps work on cricket??

uhhhh NM, stoopid question......

things like the mp3 player and such will still work, but not if you program the brew

things like vzw navigator or some other network specific app will not without significant modification or never

[Kikoshi]

things like the mp3 player and such will still work, but not if you program the brew

things like vzw navigator or some other network specific app will not without significant modification or never

Anyreason why the brew has to be Programed? Or is not needed?

[KyCpl]

Anyreason why the brew has to be Programed? Or is not needed?

far as i can tell, the brew is to get to brew apps. if thats your thing, flip it. i like the media player in verizons apps, so i'm leaving it alone. once you go to brew, you'll never get the media player again. until someone gets it going. does brew have cool stuff to add to the phone?? hhmmmmm.... im outty to google it....

[berry_lthird]

Anyreason why the brew has to be Programed? Or is not needed?

Brew is only necessary if you want to downlaod Cricket's Brew games, apps, and content.

Cricket no longer offers content over Brew.

[Kikoshi]

far as i can tell, the brew is to get to brew apps. if thats your thing, flip it. i like the media player in verizons apps, so i'm leaving it alone. once you go to brew, you'll never get the media player again. until someone gets it going. does brew have cool stuff to add to the phone?? hhmmmmm.... im outty to google it....

ah alright cool, im doing this for my dad so to keep it simple, im not goign to touch brew then .
Btw, will this also work for env2? using the 9900.dll?

[KyCpl]

The enV2 uses the same PROCESS, but with the 9100.dll!!!

[Kikoshi]

The enV2 uses the same PROCESS, but with the 9100.dll!!!

Thanks Loads bro :P, Just really want to make sure of what im doing :P

[KyCpl]

worked for me... and i'm a newbie.... one of the easier tutorials to follow, imho