Backing up HA & AAA secret keys.

[rb240z]

Originally Posted by Ultima

The actual keys are 16 lines and marked in the output as 0-15. You will notice that quite handily both HA and AAA are both there. Take the part after the "0x" and that is actual key data. Just write down (or use word, notepad, whatever) to record this for safe keeping.

If you are doing this right then you have a long string of 30 characters all strung together for each key. DOUBLE CHECK YOUR COPYING! A single mistake will cause this to fail.

There should be 32 characters correct? 16 lines with two characters a line...

[Ultima]

Originally Posted by rb240z

There should be 32 characters correct? 16 lines with two characters a line...

Yes is it 32 total characters listed just as you describe.

[m4f1050]

How can I read this in a motorola phone? I get an error, even after sending spc on QXDM... Is there a special way for motorola phones?

[Big D5]

Moved to Main TP Forum

[TPMJB]

I did everything that was described in this forum, and opened fieldtest to check my AN/AAA authentication state. It says 1 = Authenticated, yet I still get an error when trying to get data working. I'm using a custom rom so it says error 67.

Do I need to modify more than the HA and AAA shared keys to get data to work?

For data connection I have it connecting to

#777
Username: 585770****@vzw3g.com
password:vzw

ideas?

[m4f1050]

That is for a Verizon phone, for a Sprint, that returns "secret" which is only the HA, to get the AAA password, do this command:

spc (your SPC, required.)
requestnvitemread hdr_an_auth_passwd_long

The 1st one is 0x10 = 16 digits long. The next 16 values are in hex, that's the AAA password and you can use QPST to enter it if you ever need to recover it.

[sdwyz74]

Originally Posted by Ultima

Here it is guys, how to back up your HA & AAA shared secret keys in case you break your evdo through flashing roms or *228 or something similar.

Requirements:
QPST 2.7 Build 301
QXDM 3.11.36

Put your phone in DMR mode.
##3424 (send) if you use a Verizon ROM
##3424# for Sprint
I am not sure which is used by Alltel, Telus, etc. Please post if you know and I will update this post.

Run the QPST config and plug in your phone, make sure your phone is detected in the COM port list. If not click Add New Port and add the one that it has detected your phone on. What it says may vary but USB will often be in the description.

Run QXDM click Options -> Communications and set the Target Port for the same one QPST config listed for your phone.

In the command box at the top type "spc 000000"
Note: If your SPC is not 000000 then you need to use the correct number instead!

If successful you will see a window titled "Command Output" that will output some text with the final line reading "SPC Result = Correct"

Next in the command box type "requestnvitemread ds_mip_ss_user_prof"

This will get you a lot of stuff in the Command Output window. It will start with the "DIAG TX item" section, ignore this one, we are interested in the "DIAG RX item" part.

The actual keys are 16 lines and marked in the output as 0-15. You will notice that quite handily both HA and AAA are both there. Take the part after the "0x" and that is actual key data. Just write down (or use word, notepad, whatever) to record this for safe keeping.

If you are doing this right then you have a long string of 30 characters all strung together for each key. DOUBLE CHECK YOUR COPYING! A single mistake will cause this to fail.


Putting the keys back into the phone:

Load QPST service programming, go to the M.IP tab. Double click profile 0 (in the white box) and use "Enter hex value" to enter your backups of your HA and AAA keys.

Write to phone.

Soft reset. (may not be required but I do it for good measure)

Enjoy data again without another call to support for a DMU reset or multiple ESN changes.

Please leave feedback to let me know about your experience and any issues you may have!

Good QXDM information is pretty rare so please contribute if you have anything to add!

Thanks to aarondeep from the original thread http://forum.ppcgeeks.com/showthread.php?t=52727 for pointing me in the right direction.

well i have a big problem as i have moved my evo to boost and it was hell as i did not know what the FUUUU i was doing but i am boosted confirmed only problem is that no 3g i have evrything right except the 16 digit password and i cant get it as i boght the donor TP2 for 40 bucks and it's teaked i figured it was good but the USB port wont read so when i plug it in it only gives the charging symbol ??? i'm screwed as i need to access the active sync to read the values in my QXDM and write to phone using the QPST i'm desperat it's a brand new WHITE EVO ROOTED AND CUSTOM no 3g please advise thanks to all and merry X-mas

[weinerwad3000]

Originally Posted by Ultima

QXDM is a separate program from QPST, although QPST is required for (and must be running) to use QXDM.

they must have changed a lot of things with QXDM then because i have never had to have QPST running at the same time.

[weinerwad3000]

Originally Posted by sdwyz74

well i have a big problem as i have moved my evo to boost and it was hell as i did not know what the FUUUU i was doing but i am boosted confirmed only problem is that no 3g i have evrything right except the 16 digit password and i cant get it as i boght the donor TP2 for 40 bucks and it's teaked i figured it was good but the USB port wont read so when i plug it in it only gives the charging symbol ??? i'm screwed as i need to access the active sync to read the values in my QXDM and write to phone using the QPST i'm desperat it's a brand new WHITE EVO ROOTED AND CUSTOM no 3g please advise thanks to all and merry X-mas

I had the same problem with my rumor 2 because virgin mobile locks there phones up tight they disable the usb. I had to punch in ##port# and put in my msl code to enable the usb.

[RadBob1]

Here's how I found the Ha and AAA info for my Sprint Touch Pro 2.

Profile 0 and 1 have the same HA. In string it's "secret". This is what showed up in ##DATA#. When converted to hex, it's 73 65 63 72 65 74. I think this HA is the same for all Sprint and Boost phones.

Profile 0 AAA
got this in QXDM by using
spc (msl)
then
requestnvitemread hdr_an_auth_passwd_long
Looks like it was also in nv item 1192
It's also 6 sets of 2 characters each, for a total of 12 characters.

Profile 1 AAA
I couldn't get this from QXDM, but I found it's string value in ##DATA#. You have to go into the edit menu to see it. I converted this value to hex with a website converter to get my AAA. 16 sets of 2 characters each, for a total of 32 characters.

Hopefully this will be helpful to folks trying to unbreak their data.
Cheers