saving dmu secret keys

superdupe · #1 (**permalink**) 01-11-2009, 12:44 PM

hi guys

i have been flashing a few different roms to my verizonized touch pro... In doing so, it has reset settings in the MIP and Security settings causing me to have to call verizon for a DMU reset.... I have had to call them for this three times now and as most of you know it can be a pain to have to explain things...

so, this last time, i tried copying and pasting the garbled characters into a .rtf file and then saving them for later use.... I figured this would work so i flashed the phone, lost the working settings and went about the procedure to get the phone back on the verizon network....

i copied the HA and AAA secret info back from my .rtf file into the appropriate locations and figured i would have data working right of the bat... no go however... maybe they didn't save correctly or maybe verizon changed them when you use the *228 (1) feature?

has anyone done this and if so how? i also have learned to trial and error that the AAA secret key has to be written to the Security settings to get EVDO to work... Other wise you will only get 1x....

shadowmite · #2 (**permalink**) 01-11-2009, 01:10 PM

If you get the HA key from the mip profile 1 you will be able to read it as plaintext. The profile 0 16 byte key however is binary and will require qxdm to extract it. I should note, profile 0 is used for OTA provisioning of the mip profile 1. profile 1 is used for actual data.

superdupe · #3 (**permalink**) 01-11-2009, 01:34 PM

thx for the info...

can you explain how to use qxdm to save that info? also will i be able to use it again without a dmu reset if i flash and then put that info back in?

last q, you said the info shows up in plain text... can i re-enter the plain text into the default MIP profile?

Ultima · #4 (**permalink**) 01-13-2009, 03:12 AM

Quote:

Originally Posted by superdupe

thx for the info...

can you explain how to use qxdm to save that info? also will i be able to use it again without a dmu reset if i flash and then put that info back in?

last q, you said the info shows up in plain text... can i re-enter the plain text into the default MIP profile?

Good question, I'm having the same issue, though my method for fixing is a little different. Do an ESN change to another device. Make a test call with it to make sure its authenticated (#832 works) and then try the data connection to make sure its fully functional. Then put your Touch Pro back on your account and it should regenerate the keys needed for your EVDO.

NOTE: It is wise to make sure the device you are NOT in the process of activating is turned off (or in flight mode) as sometimes it can cause data auth issues.

JBHorner · #5 (**permalink**) 01-13-2009, 11:28 AM

Quote:

Originally Posted by shadowmite

If you get the HA key from the mip profile 1 you will be able to read it as plaintext. The profile 0 16 byte key however is binary and will require qxdm to extract it. I should note, profile 0 is used for OTA provisioning of the mip profile 1. profile 1 is used for actual data.

My Profile 1 doesn't populate. In fact, it says disabled.

Joel

Ultima · #6 (**permalink**) 01-13-2009, 08:02 PM

Quote:

Originally Posted by JBHorner

My Profile 1 doesn't populate. In fact, it says disabled.

Joel

Same. I'm guessing QXDM will be the final solution to this problem.

rb240z · #7 (**permalink**) 01-13-2009, 08:39 PM

I am having the same problem. had it all working perfect decided to take the plunge to a customized rom not i cant get it back. I tried to copy it from my apache but it contained symbols that wouldnt paste back correctly. i will see if i can find qxdm and try that.

Ultima · #8 (**permalink**) 01-14-2009, 01:29 AM

Ok I just need to know what the item name is for the keys in order to find them with QXDM.

Ultima · #9 (**permalink**) 01-14-2009, 11:42 PM

Any heavyweights care to chime in on this?

We are needing to know what the item name is for the secret keys in QXDM.

I know the command is: requestnviteamread xxxxxx

xxxxx is the item you are reading

In this case the HA and AAA secret keys.

Surely someone here knows this.

aarondeep · #10 (**permalink**) 01-15-2009, 02:59 AM

Not sure if this will help, but here is a shot. I found this info on the forums, but i haven't had a chance to try this yet.
I got these instructions from this post by kaeslumz,who apparently got it from pzztgotbagz
http://forum.ppcgeeks.com/showthread.php?t=27221

I modified these instructions a bit.
Instructions for QXDM 3.11.36:

1. Open EFS explorer from the QPST programs menu
2. Now click ok to select your phone and let it open up
3. Now exit EFS explorer
4. Open QXDM Professional
5. Go to options then communications and set the target port to whatever you use for QPST, mine was COM4
6. Click view and select NV Browser
7. Go to category filter and select data (as opposed to * all)
8. Scroll down until you see item 01192 "HDR Access Network Stream CHAP.."

9.Write down all the hex vales skip the first start with password 0-15
10. Now go to QPST service programming
11.Click read from phone
12.Then go to M IP Profile
13.click profile 0
14.then go to AAA shared secret and enter the hex values u wrote down do not use 0x00 just 00 and so on
15.now click ok
16.then click write to phone
17.then exit

to test if your evdo is authenticated..
##33284 and selecting debug info then HDR and all the way at the bottom it should say 1 = authenticated
If it says failed that means it didnt work and you might have to try again in case you made some mistakes in entering the hex value.