help unlocking mogul spc/msl code

[jzhou]

Originally Posted by isosdcftp

I've looked at the code for GetSPC and it looks like it takes 2 parameters, not just one. The function starts like this

STMFD   SP!, {R4-R8,LR} - store register values
SUB     SP, SP, #0xA0 - initialize stack
MOV     R4, R0 - store parameter 1 to R4
MOV     R7, R1 - store parameter 2 to r7

So, there is another parameter that is needed, I'm going too look at the rest of the files today if I have enough time. Maybe I can figure out what those parameters are.

Also, I'm new to the CDMA scene, I'm from IDEN originally. Is there a good faq or text available to learn of what all these codes/acronyms are used for?

EDIT: Parameter 1 looks to be a structure, where the first dword is a pointer to a string of '1234', and the second dword is NOT 0.

.text:0010251C                 LDR     R1, =a1234_0    ; char * - Load address of string '1234'
.text:00102520                 LDR     R0, [R4]        ; char * - Load first DWORD in parameter1's structure
.text:00102524                 BL      strcmp - Compare both Strings
.text:00102528                 CMP     R0, #0 - Check return Value
.text:0010252C                 BNE     ReturnFALSE - If the strings are not the same jump to return 0
.text:00102530                 LDR     R0, [R4,#4] - load second dword in parameter1's structure
.text:00102534                 CMP     R0, #0 - check if 0
.text:00102538                 BEQ     SetErrorTo_0x1D30C_AndReturn - jump to set last error and return

How did you get the code from the dll or exe? Can I know the tool/decompiler you used? Thanks!

[fronz]

hpnasik, looks like you have more help in the programing area.

[isosdcftp]

I've figured the parameters out, it uses a 8 character string(ESN Maybe?) to calculate the code. However since I don't know what the code is used for, I dont know if it gives the correct one.
I've attached the tool I created.

These are the two Structures given as parameters:
.

struct Par1{
char * str1; // Always point to '1234'
char * str2; // 8 char string used as input
};
struct Par2{
	char * outstr; //out, Initialize to 0, Dont forget to free after calling GetSPC
	BYTE OutSize; //out, initialize to 0
	BYTE Unk; //Unkown, initialize to 0
};

[tech-9]

Originally Posted by isosdcftp

I've figured the parameters out, it uses a 8 character string(ESN Maybe?) to calculate the code. However since I don't know what the code is used for, I dont know if it gives the correct one.
I've attached the tool I created.

These are the two Structures given as parameters:
.

struct Par1{
char * str1; // Always point to '1234'
char * str2; // 8 char string used as input
};
struct Par2{
    char * outstr; //out, Initialize to 0, Dont forget to free after calling GetSPC
    BYTE OutSize; //out, initialize to 0
    BYTE Unk; //Unkown, initialize to 0
};

=D> I WAS HAVING A HARD TIME UNLOCKING HTC TOUCH. WITH THIS THING! ZIP!! THEN BAM!! MAKE SURE YOU ENTER ESN AS YOU SEE IT, VERY IMPORTANT!! =D> =D> GURANTEED AWESOME!! YOU THE MAN!!!

[MakuSoto]

that tools works! but make sure you are entering letters in capital letters when entering the ESN and you will get the correct MSL, unless it was already changed before hand.

[hetaldp]

I can not run that FIle

Please Help saying the Error of Certificate on Mogul and 6700 also

Any other Method ??? SOS Help !!!

[ImCoKeMaN]

Is your device still application locked? If so here is the reg info to unlock that: (note i didn't come up with this info it was copied from here)

Originally Posted by scarymonkey

Unlocking the Phone (Disabling Certificate Security) (thanks flyboi)

What is the Application Lock?

By default, most Windows Mobile Smartphone devices are shipped with certificate security enabled. This places significant restrictions on the APIs which can be called by software which has not been signed and approved by authorities 'trusted' by the device manufacturer.

Why disable it?

As certification is a long and expensive proccess, it is not an option for open-source tools, or hobbyist software developers. Therefore in order to develop for smartphone devices, or apply unofficial tweaks, it is often neccessary to disable certificate security.

You can disable it by making the following registry changes:
(Requires a soft reset to take effect)
1.) HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1001 = 2
-> Change the value data from 2 to 1

2.) HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1005 = 16
-> Change the value data from 16 to 40

3.) HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1017 = 128
-> Change the value data from 128 to 144

4.) HKEY_LOCAL_MACHINE\Security\Policies\Policies
-> Change/Add new DWORD with the name "0000101b" to 1

[knobby]

Originally Posted by ImCoKeMaN

Is your device still application locked? If so here is the reg info to unlock that: (note i didn't come up with this info it was copied from here)

I've tried the abovesettings, and can't get mine working.

y entry for
3.) HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1017 = 128
-> Change the value data from 128 to 144

default is = 160

This is a fairlly new wm6.1 ROM, any ideas? Appreciate the help. I'm sriving right now and need to be able to un some apps and can't

[knobby]

I got this worked out. It seems that the problem wasn't anything to do with the certificate. I installed the .NET 3.5 Cab and it fixed all the programs I couldn't run. Whoever built it must have had the .NET left out of the ROM.

[mrgeoff]

Thank you isosdcftp!

I tried it this morning (I had to try twice... I blame fat fingers lol) and it worked like a charm

This makes things a lot easier changing the Slot Cycle Index.