help unlocking mogul spc/msl code

[drewcam888]

Verizon msl code is always 000000

[Rorge Retson]

Sorry, I guess I wasn't clear. I have a Sprint phone and want to unlock it so I can make it a Verizon phone.

[Rorge Retson]

Anyone?

[whitey10tc]

are you saying this is a regular phone. I would say call sprint and be really nice to them and ask for them to please give it to you. It worked for me last year when I flashed my Samsung to cricKet.

[Rorge Retson]

Originally Posted by whitey10tc

are you saying this is a regular phone. I would say call sprint and be really nice to them and ask for them to please give it to you. It worked for me last year when I flashed my Samsung to cricKet.

Yes - regular phone. Startac to be exact. No jokes!! Actually, it is a brand-new phone....I remember dropping my first one 50+ times and it never even turned off, much less broke.

[whitey10tc]

Yes the startacs were great but why are you posting to unlock a startac in the Titan forum. Anyway we can give the Get Spc a shot PM me you hex and dec ESN also if there is an MEID send that as well. The MSLgrabber definately won't work. You may also need to hook it up to the computer and use CDMA workshop to find it.

[Rorge Retson]

Originally Posted by whitey10tc

Yes the startacs were great but why are you posting to unlock a startac in the Titan forum. Anyway we can give the Get Spc a shot PM me you hex and dec ESN also if there is an MEID send that as well. The MSLgrabber definately won't work. You may also need to hook it up to the computer and use CDMA workshop to find it.

I did an internet search about unlocking Sprint phones and ended up here in this thread after scouring for weeks elsewhere. Thought I would give it a shot. PM sent with HEX/DEC. What's an MEID?

[jzhou]

Originally Posted by isosdcftp

I've looked at the code for GetSPC and it looks like it takes 2 parameters, not just one. The function starts like this

STMFD   SP!, {R4-R8,LR} - store register values
SUB     SP, SP, #0xA0 - initialize stack
MOV     R4, R0 - store parameter 1 to R4
MOV     R7, R1 - store parameter 2 to r7

So, there is another parameter that is needed, I'm going too look at the rest of the files today if I have enough time. Maybe I can figure out what those parameters are.

Also, I'm new to the CDMA scene, I'm from IDEN originally. Is there a good faq or text available to learn of what all these codes/acronyms are used for?

EDIT: Parameter 1 looks to be a structure, where the first dword is a pointer to a string of '1234', and the second dword is NOT 0.

.text:0010251C                 LDR     R1, =a1234_0    ; char * - Load address of string '1234'
.text:00102520                 LDR     R0, [R4]        ; char * - Load first DWORD in parameter1's structure
.text:00102524                 BL      strcmp - Compare both Strings
.text:00102528                 CMP     R0, #0 - Check return Value
.text:0010252C                 BNE     ReturnFALSE - If the strings are not the same jump to return 0
.text:00102530                 LDR     R0, [R4,#4] - load second dword in parameter1's structure
.text:00102534                 CMP     R0, #0 - check if 0
.text:00102538                 BEQ     SetErrorTo_0x1D30C_AndReturn - jump to set last error and return

How did you get the code from the dll or exe? Can I know the tool/decompiler you used? Thanks!