PPCGeeks - Palm Pre Comprehensive Guide for switching carriers, Please Sticky

Palm prē guide

NOTE: DO NOT UPDATE TO THE LATEST VERSION OF WEBOS UNTIL AFTER EVERYTHING IS WORKING CORRECTLY.
Memory addresses can change with updates and Palm may add other provisioning checks as they develop this mobile OS. Be cautious when updating.

First off I have to thank Tonycortes, GaKAsterman, Cleanser, xxRake, and Nickpl for all the wonderful information that has been contributed to this community. Please do not hesitate to look this guide over and suggest any edits or additions to this information, this is solely for the community and will not be distributed by sales, no one person put out all this information, so no one man shall profit from the work of others, therefore it is protected under creative commons licenses.

From enabling linux to getting evdo working
A start to almost finish guide to the palm prē

Okay so you just got your first palm pre, you opened the box and decided it’s just not the time for Sprint. You pop in the battery and power on your palm pre and see a screen that prompts you that you must activate this phone before actually being able to use it, this is crazy! You think to yourself, why can I not use a phone that I paid for!?

There are going to be a few things you need for this project:
• Qinray’s 1.03 WebOS image:
http://www.megaupload.com/?d=Z4R3Q7QX
• Diagnostic drivers for the palm pre:
http://mobile-files.com/forum/showthread.php?t=111201
• CDMA workshop and/or QXDM with QPST:
Unfortunately I cannot tell you were to find these, as it would be illegal to upload these. Just google it and you will find it.
There is CDMA workshop 2.7 out there, but I like QXDM and QPST more.
The versions I used were: QPST_2.15_build_231 and QXDM31136.
• Prl’s for the carrier you will want to use the pre on. They can be found here:
http://corolada.com/prl/
• For Alltel use 40051, found here:
http://www.the-answerman.com/sidlist/prl/index.asp

Step 1: So you actually want to use the phone you purchased? (Activation Bypass)

Flash your palm prē with the custom xxRake.treo8 WebOSDoctor rom, after clicking the link below click the green button to get your WebOS rom.
http://www.megaupload.com/?d=Z4R3Q7QX --> This one may be a faster location.
After it is downloaded connect your palm pre to your computer and choose charge only mode, if you haven’t done this before a driver installation will ensue, as soon as this is finished you should be ready to go. Run the jar file and once it’s done you should be good to go. Here are the instructions right off of Palm’s site:

Code:

1.     Run the tool on your computer.

2.    When prompted, connect your phone to your computer. Be sure to use the USB cable that came with your phone. webOS Doctor restores your phone's functionality and updates it to the latest software version.

3.    After your phone is reset, log into your Palm profile. Any information that you've backed up to your Palm profile is restored, including applications, contacts, and calendar events. Information from online accounts you synchronize with, such as Google or Microsoft Exchange ActiveSync, is also restored.

4.    If you have media files (picture, videos, music), docs, or other files backed up to your computer, you need to manually restore these files. You can copy the files back from your computer to your phone.

Step 2: So you want linux you say? (“Rooting” the Pre)

Now since we have bypassed activation it is time to open up the wonderful world of linux on our phone. This was known as “rooting” but has been amended to “accessing linux.”
There is a newer way on the predevwiki, but I prefer the older method of accessing linux on the pre. Here is the way I did it:

Code:

 This comes directly from the predevwiki here: http://www.webos-internals.org/wiki/...x_From_Windows

This procedure works as is with Windows XP or Vista, and can be made to work with Windows 7 by manually installing Novacom as described on the Novacom and Windows 7 page. Using an XP virtual machine (VMware or Windows 7's "XP mode") has been reported to work if you do not have a supported platform. 

Estimated time: 30 minutes depending on experience - including Next Steps after obtaining access. 

Preparation 

•    Download the webOS image. 

•    Change the file extension from .jar to .zip and then extract the archive. 

•    Run the driver installer from the extracted file by browsing to the folder webosdoctorp100ewwsprint/resources/ and running NovacomInstaller_x86.msi (for 32-bit Windows) or NovacomInstaller_x64.msi (for 64-bit Windows). 

•    Download Putty.exe from http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html. Note that there is no installation, you're simply downloading an exe you will run. Note where you downloaded it. 

•    Download and install Python 2.6 from http://www.python.org/download. Make sure it's not a more recent or an older version - it must be 2.6.x! 

o    Install using all the default choices. 

•    Get a copy of the novaproxy.py script from http://github.com/asedeno/novaproxy/...r/novaproxy.py (Right click and Save the file where you are going to remember you put it). 

The actual process 

•    Type in the Konami code on your Pre (upupdowndownleftrightleftrightbastart) to access the Developer Mode application. A blue developer icon will pop up on the Pre 



•    Open the Developer Mode application on your Pre and enable the Developer Mode switch, resetting the device when prompted. 

•    Connect the Pre to your PC using a USB cable. Choose the option to "Just Charge". Windows should see a new device called Palm Novacom and automatically install the drivers for it. If you are asked to locate the drivers yourself, they are in C:\Program Files\Palm, Inc\novacom\x86 (for 32-bit Windows) or C:\Program Files\Palm, Inc\novacom\amd64 (for 64-bit Windows). 

•    If you installed Python with all the default choices, you can simply double-click the novaproxy.py file to start Novaproxy. Otherwise, bring up a command prompt window, cd to the location in which you extracted the zip file, then type python novaproxy.py to run the script. 

•    The script will execute and provide further instructions. If it tells you it's listening on a localhost port (usually 8023), everything is working. Be sure not to close this window. 

•    If the script does not work, or tells you there is a problem and the provided instructions don't help, join our IRC channel (irc.freenode.net #webos-internals) and feel free to ask for help. 

•    Run putty.exe 

•    In PuTTY's Host Name box, type localhost and select a connection type of RAW. In the Port box, type the port that Novaproxy says it's listening on (usually 8023). 

•    Click on Terminal in the treeview on the left, and under Line discipline options, set both Local echo and Local line editing to Force off. 

•    If you want to save these settings so you don't have to set them again later, click on Session in the left treeview, enter a name for your saved connection (such as "MyPre") in the Saved Sessions box, and click the Save button. The next time you want to connect, start Novaproxy, then launch PuTTY and double-click the saved connection. 

•    Click the big Open button. Novaproxy should indicate it is connecting, and PuTTY should show a root prompt that looks like this: 

root@castle:/# 

Congrats, you are now in as root. Tread lightly.

The new way requires registration, if you want to do it this way it can be found here: http://www.webos-internals.org/wiki/...ccessing_Linux
On a sidenote you can continue with the “Next Steps” section in the wiki to install the optware packages for the pre, but they are not the main point of this guide. (However it may be in your best interest to install the optware packages if you are going to use PmModemFactory and TilIpcTest later). You will also want to look at the section about logging in via ssh, it’s very important for pretty much anything else you want to do on the pre.

Step 3: So you want to get the pre on a different carrier? (Change the SPC)

Well the first thing you are going to want to do is find the Palm pre’s SPC/MSL code, this stands for the Service Provider Code or Master Subsidiary Lock. This allows the provider to lock out certain features or makes it so the user cannot change certain items in the phone; say your mobile directory number or mobile station number, but more on that later.

Here is the mini how to GakAsterman wrote up: http://mobile-files.com/forum/showthread.php?t=111201

Quote:

Originally Posted by GakAsterman
This assumes you are using windows XP, have rooted your Pre (webOS version 1.0.3 or older only), and installed the Qualcomm COM port drivers (attached below). If you have already upgraded to 1.1 this procedure will not work, we will have to find the new location first. Palm has substantially altered the AMSS firmware, which now reads CC1.2(334).

You must also have the Qualcomm QXDM (Diagnostic Monitor) software. It's available, google is your friend.

Put your phone in passthrough mode by logging into your Pre AS ROOT:
Code:

root@castle:/# mpt d userial
** Message: serviceResponse Handling: 2, {"returnValue":true}
Pass-through enabled for Diag

Open QXDM, choose OPTIONS, then COMMUNICATIONS, and select the proper com port under "Target Port". If you can't choose the port, then go into your windows device manager and move the com port to a lower number under the advanced settings.

Look at the COMMAND line at the bottom of QXDM, it should show "Mode: Streaming" if everything is working.

Hit F4 and the memory viewer will pop up. Choose 2 rows using the dropdown, then click on the Address box and paste this address in:

Code:

0x00A5C2AA

You should see a 6 digit number on the right column followed by dots. That's your SPC/MSL!

Note, you can change it here as well by typing in a new number and clicking the Write button.

Please thank me if this works for you!

Note: if you are going to use this phone with Alltel or Verizon, change the 6 digit code to all zeros, so it looks like this --> 000000.

Step 4: So you want to get your pre working on a different network? (Almost to the data part)

Since you now have your SPC code it is very easy to get the pre on a new network.
• Connect your pre to your computer, login in via putty (you should have downloaded putty a while ago when rooting) login as root and type the command: mpt d, this will put your pre into diagnostic mode. You should see a driver install dialogue pop up and install some com ports, you will definitely be using this to connect to QPST.
• Once you have those com ports available to you configure QPST to use that port.
• Under Service Programming go to the Roaming tab and upload your PRL
• After that the easiest way to change your MDN and MSID is to go into the dialer and enter ##SPC# (SPC == your SPC)
• Then input your MSID and MDN and close the card
• If in the case that you have Alltel or Verizon you are going to want to call their customer support hotlines and try to get them to add your pre’s MEID (I told them it was a Palm Centro and they gave me no hassle adding it)
• Once that is done dial *228 for over the air activation. EDIT: Also for verizon you need to edit NV_ITEM 9000 from 02 to 01, this changes it from Sprint to Verizon.
• If you don’t want to deal with getting them to add the MEID, just clone the ESN of a different phone already on the network. NOTE: This is very much illegal and I do not condone these practices in any way. The information on this is in the thread here: http://mobile-files.com/forum/showthread.php?t=111278
• Congrats you now have voice and sms working on your palm pre on a different network.
• For a cosmetic change you can edit the palm pre’s banner by editing it with PmModemFactory. Just edit nv item 9047 and input the decimal equivalent of the word, use this tool found here: http://home2.paulschou.net/tools/xlate/

Code:

PmModemFactory –p 000000 {<--spc code}

PmModemFactory –n write 9047 {decimal equivalent of the banner name here}

Step 5: Come get some! (1xRTT data that is)

• First off the information here is provided by GakAsterman here in this thread: http://mobile-files.com/forum/showthread.php?t=111961

Quote:

Originally Posted by GakAsterman
There is a lot of talk about this problem in several other threads, so I thought it would make sense to start a new thread for it.

This specific procedure is for getting data working on Sprint if do not wish to or cannot use the over-the-air (OTA) provisioning system. If you are on another carrier, you will have to perform additional steps using QPST service programming to get data working. Read on!

This will get 1xRTT data working on a Pre with Sprint, but as yet, no EVDO. (UPDATE: HERE is the procedure for getting EVDO working on Sprint once you have 1xRTT working as laid out below)

Note that this method can only be used if you have rooted your Pre and have shell access. See the Pre Dev Wiki for more information on how to do this. Do not discuss it here, it is off-topic.

I have discovered that the Pre determines it's "Provisioned" status by looking at the NAI in profile 1 when you use TilIpcTest to set the parameters. I am unsure if other methods will set the "provisioned" status correctly, so to be sure, use TilIpcTest. If the NAI ends with anything other than "@sprintpcs.com" then it will still consider the data services "unprovisioned" and not attempt to start data!

Note: TilIpcTest and other utilities such as PmModemFactory were removed by Palm in the 1.0.4 update, so in order to provision 1.0.4 or newer, you'll have to copy in the them from the 1.0.3 webOSdoctor. (do not forget to chmod 755 them once copied to make them executable if you do!) This seems to work without any problems. Do not ask me for a copy, as I cannot and will not provide it because it is copyrighted Palm code!

To use this method, log in to your Pre as root and run TilIpcTest. You will see something like this:

Code:

:/# TilIpcTest 

** (process:7462): DEBUG: Registered object path: Client com.palm.phone /com/palm/phone

** (process:7462): DEBUG: Registered object path: Client com.palm.phoneN /com/palm/phone

** (process:7462): DEBUG: Run loop client.

** (process:7462): DEBUG: Run loop client.

** (process:7462): DEBUG: Registered object path: Client com.palm.bluetooth /com/palm/bluetooth

It will stall here for about 5-10 seconds, then print a LONG menu:

Code:

TELEPHONY Test Menu

1 : Power ON 

2 : Power OFF 

3 : Dial Call

4 : End Call

5 : Answer Call

6 : Conference Calls

7 : Extract  Call

8 : Swap Calls

9 : Send DTMF

10: Send SMS

11: Gps Get Fix

12: Gps Cancel Fix

13: EMPTY

14: Gps Clear

15: Gps Logging

16: Set Audio Profile

17: Get Audio Profile

18: Set TTY Mode

19: Get TTY Mode

20: Get Flight Mode

21: Start Continuous Dtmf

22: Stop Continuous Dtmf

23: Bluetooth Menu

24: Send Ussd

25: Set Voicemail

26: Get Voicemail

27: Set Callforward

28: Get Callforward

29: Set CallWait

30: Get GetCallWait

31: Set SMS Delivery

32: Set SMS Msg Service Options

33: Get SMS Msg Service Options

34: Enter Radio Debug Mode: [enable/disable]

35: Enter Program Mode

36: Exit Program Mode

37: Get Activation Info

38: Set Activation Info

39: Set ForwardingStatus

40: GetFwCarrier Db values for GSM only

41: Go To CDMA Misc Test Menu

42: Gps Test Runs

43: Get CLIR settings

44: Get CLIP settings

45: Restore Radio NV Defaults

46: Get PDP Profile

47: Set PDP Profile

48: Set Active Line

49: Get Active Line

50: Get Network Band

51: Set Network Band

52: Reset Radio 

53: EMPTY

54: Lock phone

55: Unlock phone

56: Get phone lock state

57: Change phone lock password

58: End Emergency Mode

59: Exit TIL

60: GetDtmfDuration

61: SetDtmfDuration

62: Charging

63: Get Active PDP

64: Set Active PDP

65: Activate Til

66: Send Flash

67: Enable Sending RSSI

68: Disable Sending RSSI

69: Gps Get/Set Location Privacy Mode

70: Mute

71: Unmute

72: Get Provisioning Status

73: Get Charging Support

74: Get IPC Interface Version

75: Set Mode Preference

76: EMPTY

77: Set Call Barring Status

78: Get Call Barring Status

79: Change Call Barring Password

80: Suspend enable/disable

81: Send HardCoded UCS2 SMS for GSM only

82: Set Audio Modem Tuning Params

83: Get Audio Modem Tuning Params

84: Get CNAP Settings

85: Goto Default State

86: Gps Mt Fix Response

87: Send Ussd Response

88: Cancel Ussd

89: Get RadioType

90: Get Charger Setting

91: Get Charger Status

92: Set System Time

93: Get Network Mode Selection

94: Sim Command for GSM only

95: GetNetworkId for GSM only

96: GetNetworkList for GSM only

97: SetNetwok for GSM only

98: GetMsInfoString

99: Exit



Enter a Choice:

Because this menu is so long, and it will re-print the menu after each command, you will have to use your scrollback buffer or some other method to capture all output.

Enter option 72, by typing 72 and pressing enter, and remember, you have to scroll back! It will display your provisioned status before re-printing the menu. Your data status will show as unprovisioned if you have not set the NAI correctly to a something@sprintpcs.com in profile 1.

Do a 46 and choose 1, then it will print out your current settings:

Code:

Enter a Choice: 46

Enter Profile Index: 1



....COMMAND: "getpdpprofile"



....RESPONSE: "success"

 userName: "myusername@sprintpcs.com"

 spiMnHa: "1234"

 spiMnAaa: "1234"

 homeAddr: "0.0.0.0"

 primHomeAgent: "68.28.15.12"

 secHomeAgent: "68.28.31.12"

 revTunnelPref: "yes"

 aaaPasswd: "notprintable"

 haPasswd: "secret"

This is profile 1 from a Pre with an active Sprint data connection. NEVER EVER alter profile 0! This is the default profile that is used when you are unprovisioned that lets it auto-provision. Once you set profile #1, then profile 0 is ignored, so there is no reason to trash it. You may someday wish to return to stock.

If you are on a carrier other than Sprint, you MUST still set the NAI to something@sprintpcs.com in profile 1 in order to have the Pre attempt a data connection. I recommend you simply enter the parameters above as shown to get it provisioned, then use QPST Service Programming to set a new profile up in slot 2 with your carrier's parameters.

To set custom settings in profile 1, first choose option 64(set active PDP) and then enter 1 for the profile. This tells the phone to use profile 1 instead of 0. Then select option 41 (CDMA menu), and from there choose 223 (set OMA-DM nodes). You will see this:

Code:

Enter a Choice: 223



....COMMAND: "SetOmaDmNodes"



 Enter the node to be written

    0     - ./cdma/3gpd/profile1/authalgoaaa 

    1     - ./cdma/3gpd/profile1/authalgoha 

    2     - ./cdma/3gpd/profile1/mobileipaddress 

    3     - ./cdma/3gpd/profile1/nai 

    4     - ./cdma/3gpd/profile1/prihaip 

    5     - ./cdma/3gpd/profile1/reversetunneling 

    6     - ./cdma/3gpd/profile1/sechaip 

    7     - ./cdma/3gpd/profile1/spiaaa 

    8     - ./cdma/3gpd/profile1/spiha 

    9     - ./cdma/3gpd/profile1/passwordaaa 

    10     - ./cdma/3gpd/profile1/passwordha 

    11     - ./cdma/nam 

    12     - ./cdma/nam/cdmanam 

    13     - ./cdma/nam/mobdirnum 

    14     - ./devinfo/devid 

    15     - ./cdma/prl 

    16     - ./cdma/prl/maxprlsize 

    17     - ./cdma/prl/prefroamlist 

    18     - ./cdma/prl/prlid 

    19     - ./devdetail 

    20     - ./devdetail/devtyp 

    21     - ./devdetail/ext/personal/carname 

    22     - ./devdetail/fmv 

    23     - ./devdetail/swv 

     99 = to exit

You can then enter your parameters one at a time by choosing the item you wish to change. 2-10 are the relevant data options. I do not recommend you change anything else. Once you are done, choose 99, then 299, then 46, then 1. It will print out the settings again. Confirm everything is right, and if so, do a 52 (reset radio). If your settings were valid, your data will come up. If you don't have your HDR settings correct in NV, then you will see the Ev icon light up, only to be replaced with 1x after a few seconds. But if 1x comes up, then you have at least successfully provisioned 1xRTT data! Congratulations!

If you do not have access to the correct settings for HDR (EVDO), or if your carrier/plan doesn't support it, then I recommend you do a 209 from within the 41 menu and set your mode to 1xonly, that way it will connect faster and there will be no re-attempts on EVDO.

If you have your HDR settings, they will have to be set in NV and in one memory location directly before EVDO will work. The post HERE shows how to accomplish this. It can be done any number of ways, but the easiest is with PmModemFactory. Palm also deleted this during the 1.0.4 update, so again, you'll have to get it from 1.0.3 or older. (see above)

If this was helpful please thank me, and if you run into trouble, please first READ THE WHOLE THREAD then, if you are still stumped, post a reply to this topic so we can all work together to solve the problem. Do NOT PM me! You will simply be wasting your time and my time. I prefer to answer in the forums where it can benefit everyone. Also, if you discover new information on this topic, it would be awesome if you shared it with us here!

UPDATE: If you are on Sprint, HERE is the procedure for getting EVDO working.

Step: 6: So you think you can handle Full Evdo? Well here it is…

First you might need some settings, so these settings will be different depending on the provider, I will try to compile a list of them.

Here are alltel's various settings, thanks to Nickpl:

Quote:

Following tonycortes directions here http://mobile-files.com/forum/showthread.php?t=112455 I was able to get 1x data working, just eveo would not authenicate for me, here are the magic settings I had to change in QPST to get it to work (I found these settings here http://forum.xda-developers.com/arch.../t-424884.html)
First make sure that 1x is working, then

Under Data tab
MDR Mode SVC Opt 33 Prfd
Service Option Pre 707
Data QNC Should Actally be checked, thanks tonycortes!
Data SCRM checked

Under M.IP tab I setup mine under profile 2, under profile 2

NAI is {cellnumber}@alltel.net
Tethered NAI is {cellnumber}@alltel.net
HA Shared Secret I got off my old Palm 700wx, for me it was UPwi3ujNIny+7ST2, might be differant for you
AAA Shared Secret is alltel
MN-HA is 101
MN-AAA is 3E8
Rev Tunnel Preferred is checked
Home Addres is 0.0.0.0
Primart HA Address is 255.255.255.255
Secondary HA address is 68.28.113.76

Under PPP config, under UM
Tethered NAI is {cellnumber}@alltel.net
UserID is {cellnumber}@alltel.net
Password is alltel
Optimized Dormant Handoff is checked

Under PPP config, under AN
userID is {cellnumber}@alltel.net
Password is my hex ESN in all caps

and that's it!

Profile 1 and 0 are both enabled, but I used TilIpTest to set profile 2 to active following GakAsterman directions here http://mobile-files.com/forum/showpo...86&postcount=1 To set custom settings in profile 2, first choose option 64(set active PDP) and then enter 2 for the profile.

Profile 1 has all the same setting as Profile 2, the only differance being that the NAI and tethered NAI are set to {whatever}@sprintpcs.com

Note that ##debug# still show auth failed, but EVEO works great!

Also, for MMS on Alltel, login as root

Code:

PmModemFactory -p 000000 {<-- that's your spc code}



PmModemFactory -n write 9021 104 116 116 112 58 47 47 109 109 115 45 109 116 46 97 108 108 116 101 108 46 110 101 116 47 115 101 114 118 108 101 116 115 47 109 109 115

That will set NV item 9021 to http://mms-mt.alltel.net/servlets/mms

The initial information is provided by TonyCortes in this thread: http://mobile-files.com/forum/showthread.php?t=112455

Quote:

Latest Palm Pre WebOS 1.1 has made major changes to it's core. SprintDaemon is no more an issue and a few other barriers. The PPP setup is now very friendly to other carriers (I believe this is in preparation for their upcoming additional CDMA carrier). This works for SIMPLE IP supporting carriers (Verizon, Cricket, MetroPCS, etc). This also means no custom ppp setup, pmfactory hassles, etc etc. Just regular old QPST will do:

Note: You should be very familiar with what is meant, otherwise SEARCH please. I also repeat, do not edit any other items, just follow as mentioned.

1) Update Device (many data settings will change after update)
3) Root and Enable pass through (mpt d)
4) Read phone with Service Programming (QPST)
5) Under MIP tab set phone to SIMPLE IP behavior.
6) Edit Profile 1 (not Profile 0) and only that one. Change the NAI to whatever@sprintpcs.com (sets provisioning)
7) Go to PPP tab, change username and password for both UM/AN sections
(repeat writes on this may be required for it to stick)
8) Go to ROAM tab, write your PRL as it may have changed after 1.1 update
9) Your connection should be up shortly or after reboot.

Only getting 1x with Verizon? Do the above than try this by cleanser:
Quote:
To get 1x working you may have to hit ##EVDO# and force it to 1x.

Once your 1x connection is established. (Test this with your browser)
Load up QPST
Go to the MIP tab:
Dont touch profiles 0 and 1
Create a new profile (i used profile 2) input your settings NAI etc etc.
Enable that profile. And set as active
go to mobile ip settings and set it as MIP + SIP
Write it.
Re-read it a few times to make sure it stuck, it does have issues with not taking the info the first time.
Go back to ##EVDO# and set it to Hybrid Rev A
Your evdo should come up!

NOTE: Here is a way to get your HA shared key and AAA key:

his is something I found over on PPCGeeks, could be of use:

Quote:

Here it is guys, how to back up your HA & AAA shared secret keys in case you break your evdo through flashing roms or *228 or something similar.

Requirements:
QPST 2.7 Build 301
QXDM 3.11.36

Put your phone in DMR mode.
##3424 (send) if you use a Verizon ROM
##3424# for Sprint
I am not sure which is used by Alltel, Telus, etc. Please post if you know and I will update this post.

Run the QPST config and plug in your phone, make sure your phone is detected in the COM port list. If not click Add New Port and add the one that it has detected your phone on. What it says may vary but USB will often be in the description.

Run QXDM click Options -> Communications and set the Target Port for the same one QPST config listed for your phone.

In the command box at the top type "spc 000000"
Note: If your SPC is not 000000 then you need to use the correct number instead!

If successful you will see a window titled "Command Output" that will output some text with the final line reading "SPC Result = Correct"

Next in the command box type "requestnvitemread ds_mip_ss_user_prof"

This will get you a lot of stuff in the Command Output window. It will start with the "DIAG TX item" section, ignore this one, we are interested in the "DIAG RX item" part.

The actual keys are 16 lines and marked in the output as 0-15. You will notice that quite handily both HA and AAA are both there. Take the part after the "0x" and that is actual key data. Just write down (or use word, notepad, whatever) to record this for safe keeping.

If you are doing this right then you have a long string of 30 characters all strung together for each key. DOUBLE CHECK YOUR COPYING! A single mistake will cause this to fail.

Putting the keys back into the phone:

Load QPST service programming, go to the M.IP tab. Double click profile 0 (in the white box) and use "Enter hex value" to enter your backups of your HA and AAA keys.

Write to phone.

Soft reset. (may not be required but I do it for good measure)

Enjoy data again without another call to support for a DMU reset or multiple ESN changes.

Please leave feedback to let me know about your experience and any issues you may have!

Good QXDM information is pretty rare so please contribute if you have anything to add!

Thanks to aarondeep from the original thread http://forum.ppcgeeks.com/showthread.php?t=52727for pointing me in the right direction.

This work is licensed under the Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License all credits should goto the author of this guide, Tonycortes, GakAsterman, Cleanser, and Nickpl. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-sa/3.0/us/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA.