Finding the SPC on Sprint/US Cellular Blackberry's

[thesmitty68521]

I am copying and pasting this directly from Mobile Files. This is very useful in finding the SPC for the Blackberry. If this doesn't work, downgrade the OS on the Blackberry. Biglou23 has a post on this somewhere.

This is courtesy of Tonycortes from Mobile Files:

I've updated my guide, enjoy, larger ranges (takes a few more seconds to read, but higher success rate):

1) Install QXDM (2.08 Release Recommended)

2) Install Blackberry Desktop Manager (Should create two RIM Virtual Ports on PC)

3) Run Blackberry Desktop Manager the entire time (Device should show connected)

4) Using UniCDMA read MSL/SPC from the following:

Blackberry 8130 Pearl
Address: 0x106C0000 Length: 1703936
Address: 0x10130000 Length: 500000

Blackberry 8330 Curve
Address: 0x10700000 Length: 1703936

Blackberry 8703e
Address: 0x10050000 Length: 1703936

Blackberry 8800
Address: 0x10630000 Length: 1703936

Blackberry 8830 WE
Address: 0x10600000 Length: 500000

5) With WinHex (or equivalent HEX Editor) search for 6-digit code in the memory dump by using the GATHER TEXT feature in the SPECIALIST menu. Use this tool to filter out unnecessary characters. I recommend setting the GATHER TEXT feature to 6 succession, only numbers and have Unicode characters tolerated.

6) Once you obtain the SPC/MSL, exit UniCDMA and run QXDM.

7) Configure QPST (globe in system tray) and QXDM to the correct ports, phone must show detected.

8) Using QXDM (ensure VIEW is set to COMMAND OUTPUT) type the following commands:

a) mode offline-d
Turns radio off and sets to service mode. Check phone radio is off.

b) spc "******"
Replace asteriks with the 6 digit code. Output should read successful.

c) pr_list_wr 0 "C:\prl_1039.prl"
If needed change file path to location of PRL. Output should read successful.

d) nv_write sec_code {"000000"}
Optional: use this command to change code to zeros or another 6 digits.

e) mode reset
Reboots phone to reset mode.

9) Finally, through the phone type #4357* (#HELP*) to verify the PRL write.

##6digitMSL and SEND to start NAM Programming

NOTE: If PRL reverts (SPRINT), use QXDM command to read and disable NAM_LOCK:
a) nv_read nam_lock (should read enabled, which we'll change in the next command)
b) nv_write nam_lock 0 0 (disables)

Then proceed with UniPST and the RIM DLL to edit the registration ID (and List) to "2004"

note: i only ask that no one claims anything. by the way, reg id help goes credit to another member, i forgot his name, but you know who you are.

The only part where I do this differently is: To change the REG ID simply enter ##000000 + Send and go from there. Much easeir than Unipst. Once again, I didn't come up with this.

[user1]

any luck with curve 2 from ussc

[thesmitty68521]

What is the model number for that? Another way to do that is to do a scan on CDMA Workshop. That tells you the readable areas of the phone.

That and see if a carrier like verizon offers the same model and downgrade the OS to that one. It will allow you to find the SPC

[bawanyh]

Curve 2 I think you cannot downgrade there software is already upgraded and the downgrade on blackberry website is not available. Have you tried the calculator in the new CDMA Workshop? That might help. It doesn't help on sprint ones but I dont know about USSC.

Thanks

[k3rrsed]

I am working with a fellow that is attempting to develop an algorithm for Sprint SPCs based on ESN, so if you would like to assist us with developing a FREE solution for generating Sprint SPCs for newer BBs, please pm me your findings, or post them here wherever relevant.

[kc720]

to change bb reg id while flashing prl with qxdm :
1) mode offline-d
2) spc "000000"
3) nv_write_item 11055 0xD4 0x07
4) nv_write_item 11089 0x01 0xD4 0x07
5) mode reset

[bawanyh]

to change bb reg id while flashing prl with qxdm :
1) mode offline-d
2) spc "000000"
3) nv_write_item 11055 0xD4 0x07
4) nv_write_item 11089 0x01 0xD4 0x07
5) mode reset


Hey kc these commands are for the old QXDM right? The new version of QXDM has little different commands.

[kc720]

that works on version 3.05

[Dex]

the new versions of QXDM use a special command to do the settings i would suggest if u have windows 7 is to use XP Mode and QXDM 2.08 it works great if u dont have WS trust me i did it today if u need help with it i can help i suggest a computer with Hardware Virtualization its a feature thats enabled in the bios i will post the download for windows XP mode and windows virtual pc for windows 7 it is the best if u dont have workshop

[kc720]

personally i use two versions of qxdm. 3.05 which i run off of a folder on the desktop (no installation needed) and 3.9 which i install and use. the 3.9 uses the command structure of "request_write_nv_item" something like that. i dont remember off the top of my head

[Dex]

that is correct but to write the prl using the new version from what i heard u have to code it by hex the whole prl to the fone

[ELHULK]

how do i find spc with cdmawork shop

[blevinski]

try ram methad

[dafkuwant]

Anybody know how to get spc for 8330m on USCC? Its on 4.5.0.169 software an cant read the spc with unicdma and cdmaworkshop. I looked for downgrade software but no luck

[Pac3comm1]

Smitty took the words right out of my mouth. Even if you purchased the liscense for it, to me it would be worth more than the lonhanded work involved for six digits.

[Pac3comm1]

There isnt a downgrade for USCC, but if you wipe device apps with crack utilities, you can load a low security version of OS like Verizon or Alltel. Just make sure the OS version is lower than 169.

[ttoo]

I just did all steps.. however, both unicdma and cdma workshop doesn't recognize com port.. well, I tested com port with qpst conf..1. bb 8130 was on dektop manager. 2. turn on qpst.. it was found in com4.. 3. open unicdma.. failed/ cdma failed.
however,winhex was able to show entire ram. ..
I could see esn hex number there.
Could u give me another tips to work out spc number? pls

[whitey10tc]

I just did all steps.. however, both unicdma and cdma workshop doesn't recognize com port.. well, I tested com port with qpst conf..1. bb 8130 was on dektop manager. 2. turn on qpst.. it was found in com4.. 3. open unicdma.. failed/ cdma failed.
however,winhex was able to show entire ram. ..
I could see esn hex number there.
Could u give me another tips to work out spc number? plsDelete the com from QPST config and then close QPST and see if that helps.

[ttoo]

Yes, unicdma/cdma workshop both work fine... however, when just try to read in unicdma.. the address part has error on it.. should look for another address? what do u think..
:12:18 AM : Monitor enabled
9:17:02 AM : Reading 500000 bytes of memory, starting from 0x10130000
9:17:02 AM : Read error at address 0x10130000
9:17:38 AM : Reading 1703936 bytes of memory, starting from 0x106C0000
9:17:38 AM : Read error at address 0x106C0000

[Pac3comm1]

OR< you can just use CDMA workshop and scan from 1070 to 1073. If the SPC is not located there, then use increments of five until you locate it. I.E. 1073 to 1078.

[klct555]

Any word on sprint 8530 MSL/SPC? its impossible to get when them phone has been blacklisted.

[ttoo]

on the san memory, star address ->1073:0000, end address1078:ffff
1078 to 1083.. so on. however, still saying phone doesn't answer it..
AM I DONING RIGHT PROCEDURE, I JUST WANT TO CHECK.. CAN U GIVE A LITTLE BIT MORE DETAILED TIPS? I APPRECIATE IT

[ttoo]

on the san memory, star address ->1073:0000, end address1078:ffff
1078 to 1083.. so on. however, still saying phone doesn't answer it..
AM I DONING RIGHT PROCEDURE, I JUST WANT TO CHECK.. CAN U GIVE A LITTLE BIT MORE DETAILED TIPS? I APPRECIATE IT

[ownmart]

you'll have to purchase the spc code from ebay or someone else, or you may be able to read all readable addresses on phone

[Brandon69147]

Desperately trying to flash Sprint Blackberry 8330 to Cricket and am having difficulty identifying the SPC since, as I've read and learned ##000000 only works on Verizon phones. Desktop Manager runs fine and connects to the device on COM2. UniCDMA loads itself but after changing the PORT to COM2 and entering the Address and Length, UniCDMA returns a message saying that 0x10700000 is a bad integer. I also tried using the modified address that I found in another posting with a similar result. It's my understanding that I can't move forward with any of the other steps until I can identify the SPC code. Any suggestions?

Blackberry 8330 Curve
Address: 0x10700000 Length: 1703936

Brandon

[braindeadhacker]

Anyone tried using PSAS for the spc?Im trying it now,who knows?

[Guest]

UniCDMA returns a message saying that 0x10700000 is a bad integer. I also tried using the modified address that I found in another posting with a similar result. It's my understanding that I can't move forward with any of the other steps until I can identify the SPC code. Any suggestions?

Blackberry 8330 Curve
Address: 0x10700000 Length: 1703936

Brandon

I don't use UniCDMA, but I suggest you try just entering 10700000, although the error must be related to the result of converting what you typed in since the address isn't in decimal anyhow. The " 0x " would cause the conversion to fail unless the software was smart enough to filter that prefix out. Similar to how CDMA Workshop isn't smart enough to work without the " : " in there.

1.7MB is a lot of searching, I bet you find it real close to '1070FA00'

[Pac3comm1]

You need to use MFI multiloader to do a COMPLETE wipe of the device. Then use CDMA workshop full version for the rest. Then you can load the OS back to it and it will stick

[thesmitty68521]

i bought pink 8130 sprint from us and tried to change the esn. after doing all the steps of wihex qxdm calculator and then write with unicdma. unicdma says successful after reboot esn reverts to its original.
will anyone help me????????????

Please read our forum rules. Any requests for ESN changes is strictly forbidden and is a violation of the forum rules. Also, please start your own thread in the appropriate part of the forum. This is thread hijacking.

[braindeadhacker]

I have a 8330 with sprint svc.Ive downgraded to the 4.5.0.131 os and no matter what I do I CAN NOT GET THE SPC!!!!Ive tried cdma wksp,unicdma,bitpim,and even psas.I get the range error on cdmawksp and Im at my wits end with this thing.Can someone help me out before I put this mother%^$#er in a microwave?Please?Thanks.

[Pac3comm1]

4.5.131 now prevents access from external software. You will need to downgrade even further if you have an older version available, or swap firmware with one that has less security measures such as Alltel or Verizon. BUT MAKE SURE YOU USE THE OLDEST VERSION YOU CAN FIND