Palm Pre Complete Guide

[meanngreen04]

[b]First, you will need the Palm SDK and Virtual Box.
Download it here.
[Only registered and activated users can see links] age&id=1788&Itemid=321#


Follow installation procedures for your OS. This will install needed components to gain access to root of your Pre.

If your device has already been activated, proceed to the next post. If not, we need to bypass activation.

This is a complicated process, but don't give up. To bypass activation we need a modified webOS doctor. This is the java program that flashes your pre. Put your phone into Developer Mode. Do this by going to Launcher and typing "webos20090606". Another window will pop up, slide it over and turn on Developer Mode. Confirm and let phone reboot. If it hangs, hold Orange key and R to reset.

For sprint users, you may download this rom I have uploaded to save your an hour or so of time. It's in 2 parts. Just combine the 2 parts and doubleclick the jar file. Connect your phone to your usb port. All drivers were installed with Palm SDK. Follow the directions to let webos doctor flash your phone. If your phone is not recongized, place it in bootloader by removing the battery and unplugging the phone from usb. Next, plug in usb while holding the up volume. Install battery. Phone should show large USB symbol. Now proceed with rom installation. Once complete the phone should reboot. If it fails for any reason, remove battery and let phone power up. Hard to brick these things.

Download these 2 parts and combine them:
[Only registered and activated users can see links]
[Only registered and activated users can see links]


If your pre is on another carrier, you must create a doctored os for it. Go here and follow the directions.

[Only registered and activated users can see links]

[meanngreen04]

Installing Preware

If you're here, you have access to your phone and have bypassed activation.

We need to install Preware next. Important do not skip this step. We need a program called Terminal on the phone. If we don't have this program, your phone will be stuck in mpt mode and have no option to use the phone as a usb device.

Go here and follow directions to get WebOS Quick Install.

[Only registered and activated users can see links]

Next, Install Preware.

Run WebOS Quick Install
Run WebOS Quick Install
Press the third button on the right
Choose WebOS Internals Feed (all) from the dropdown list at the top.
Select Package Manager Service from the list.
Press DOWNLOAD.
Press INSTALL.
Press the third button on the right
Choose WebOS Internals Feed (all) from the dropdown list at the top.
Select Preware from the list.
Press DOWNLOAD.
Press INSTALL.
If WebOS Quick Install offers to install the Package Manager Service automatically to enable tweaking, do not agree. It will install the wrong version. You must install it as detailed above.

Access your wifi. Click on Preware and let the packages load. It'll take a while. Find the program called Terminal and install.

[meanngreen04]

[Only registered and activated users can see links]

Now you need to turn on diagnostic mode that you may connect to QPST or cdma.

In the command prompt type mpt 0d.

Your computer should now be searching for drivers.

The drivers can be found here.
[Only registered and activated users can see links]


Now you can access the pre through QPST or CDMA workshop.

SPCC

Open QXDM, choose OPTIONS, then COMMUNICATIONS, and select the proper com port under "Target Port". If you can't choose the port, then go into your windows device manager and move the com port to a lower number under the advanced settings.

Look at the COMMAND line at the bottom of QXDM, it should show "Mode: Streaming" if everything is working.

Hit F4 and the memory viewer will pop up. Choose 2 rows using the dropdown, then click on the Address box and paste this address in:



Code:
0x00A5C2AA
You should see a 6 digit number on the right column followed by dots. That's your SPC/MSL!

Note, you can change it here as well by typing in a new number and clicking the Write button.



Proceed to load your prl and min/mdn.

Since you now have your SPC code it is very easy to get the pre on a new network.
• Connect your pre to your computer, login in via putty (you should have downloaded putty a while ago when rooting) login as root and type the command: mpt d, this will put your pre into diagnostic mode. You should see a driver install dialogue pop up and install some com ports, you will definitely be using this to connect to QPST.
• Once you have those com ports available to you configure QPST to use that port.
• Under Service Programming go to the Roaming tab and upload your PRL
• After that the easiest way to change your MDN and MSID is to go into the dialer and enter ##SPC# (SPC == your SPC)
• Then input your MSID and MDN and close the card
• If in the case that you have Alltel or Verizon you are going to want to call their customer support hotlines and try to get them to add your pre’s MEID (I told them it was a Palm Centro and they gave me no hassle adding it)
• Once that is done dial *228 for over the air activation. EDIT: Also for verizon you need to edit NV_ITEM 9000 from 02 to 01, this changes it from Sprint to Verizon.
• If you don’t want to deal with getting them to add the MEID, just clone the ESN of a different phone already on the network. NOTE: This is very much illegal and I do not condone these practices in any way. The information on this is in the thread here: [Only Registered Users Can See Links Click Here To Register]
• Congrats you now have voice and sms working on your palm pre on a different network

You may access the sid/nid by typing ##data

[meanngreen04]

This Data is from M-F adactuslatem. Thanks to Tonycortes, GaKAsterman, Cleanser, xxRake, and Nickp.



Quote:
Latest Palm Pre WebOS 1.1 has made major changes to it's core. SprintDaemon is no more an issue and a few other barriers. The PPP setup is now very friendly to other carriers (I believe this is in preparation for their upcoming additional CDMA carrier). This works for SIMPLE IP supporting carriers (Verizon, Cricket, MetroPCS, etc). This also means no custom ppp setup, pmfactory hassles, etc etc. Just regular old QPST will do:

Note: You should be very familiar with what is meant, otherwise SEARCH please. I also repeat, do not edit any other items, just follow as mentioned.

1) Update Device (many data settings will change after update)
3) Root and Enable pass through (mpt d)
4) Read phone with Service Programming (QPST)
5) Under MIP tab set phone to SIMPLE IP behavior.
6) Edit Profile 1 (not Profile 0) and only that one. Change the NAI to [Only Registered Users Can See Links Click Here To Register] (sets provisioning)
7) Go to PPP tab, change username and password for both UM/AN sections
(repeat writes on this may be required for it to stick)
8) Go to ROAM tab, write your PRL as it may have changed after 1.1 update
9) Your connection should be up shortly or after reboot.

Only getting 1x with Verizon? Do the above than try this by cleanser:
Quote:
To get 1x working you may have to hit ##EVDO# and force it to 1x.

Once your 1x connection is established. (Test this with your browser)
Load up QPST
Go to the MIP tab:
Dont touch profiles 0 and 1
Create a new profile (i used profile 2) input your settings NAI etc etc.
Enable that profile. And set as active
go to mobile ip settings and set it as MIP + SIP
Write it.
Re-read it a few times to make sure it stuck, it does have issues with not taking the info the first time.
Go back to ##EVDO# and set it to Hybrid Rev A
Your evdo should come up!

Update: Here are some screens for what your QPST profiles should look like to get provisioned and what profile 2 should look like to get EVDO working.

If you are using QPST your profile 0 and 1 and 2 settings should look as follows:
Profile 0: Blacked out places is your MEID

Profile 1: Blacked out places is your MEID

Profile 2: Replace with Carrier settings, also you will notice mine is not enabled, try to enable it and then set profile 2 as active and write to the phone a few times, it just doesn't show up, but mine works, so it should work just fine if the guide is followed directly. Blacked out place is your phone number.


M.I.P. Profile:


NOTE: Here is a way to get your HA shared key and AAA key:

This is something I found over on PPCGeeks, could be of use:


Quote:
Here it is guys, how to back up your HA & AAA shared secret keys in case you break your evdo through flashing roms or *228 or something similar.

Requirements:
QPST 2.7 Build 301
QXDM 3.11.36

Put your phone in DMR mode.
##3424 (send) if you use a Verizon ROM
##3424# for Sprint
I am not sure which is used by Alltel, Telus, etc. Please post if you know and I will update this post.

Run the QPST config and plug in your phone, make sure your phone is detected in the COM port list. If not click Add New Port and add the one that it has detected your phone on. What it says may vary but USB will often be in the description.

Run QXDM click Options -> Communications and set the Target Port for the same one QPST config listed for your phone.

In the command box at the top type "spc 000000"
Note: If your SPC is not 000000 then you need to use the correct number instead!

If successful you will see a window titled "Command Output" that will output some text with the final line reading "SPC Result = Correct"

Next in the command box type "requestnvitemread ds_mip_ss_user_prof"

This will get you a lot of stuff in the Command Output window. It will start with the "DIAG TX item" section, ignore this one, we are interested in the "DIAG RX item" part.

The actual keys are 16 lines and marked in the output as 0-15. You will notice that quite handily both HA and AAA are both there. Take the part after the "0x" and that is actual key data. Just write down (or use word, notepad, whatever) to record this for safe keeping.

If you are doing this right then you have a long string of 30 characters all strung together for each key. DOUBLE CHECK YOUR COPYING! A single mistake will cause this to fail.


Putting the keys back into the phone:

Load QPST service programming, go to the M.IP tab. Double click profile 0 (in the white box) and use "Enter hex value" to enter your backups of your HA and AAA keys.

Write to phone.

Soft reset. (may not be required but I do it for good measure)

Enjoy data again without another call to support for a DMU reset or multiple ESN changes.

Default Various Data settings for different carriers


--------------------------------------------------------------------------------

US Cellular

[Only registered and activated users can see links]
[Only registered and activated users can see links]
HA Shared Secret: Need to get this from a US Cellular device
AAA Shared Secret: (haven't found this yet)
MN-HA: 10E1
MN-AAA: 2
Rev Tunnel Preferred: enable
Home Address: 0.0.0.0
Primary HA Address: 255.255.255.255
Secondary HA address: 255.255.255.255
DMU Public Key: 41

Cricket

[Only registered and activated users can see links]
[Only registered and activated users can see links]
HA Shared Secret:
AAA Shared Secret:
MN-HA:
MN-AAA:
Rev Tunnel Preferred: enable
Home Address: 0.0.0.0
Primary HA Address: 192.190.109.42
Secondary HA address: 192.190.109.43
DMU Public Key:
[Only registered and activated users can see links]
PAP/PPP pass: cricket

UPDATE 8/13/09

Verizon


Profile Enabled: yes
[Only registered and activated users can see links]
[Only registered and activated users can see links]
Rev Tunnel Preferred: yes
Home address: 0.0.0.0
Primary HA address: 255.255.255.255
Seconday HA address: 255.255.255.255
MN-HA SPI: 12C
MN-AAA SPI: 2
DMU Public Key ID: 10
DMU Mobile Authenticator:
HA Shared Secret:
AAA Shared Secret:
Active User Profile: 2

Mobile IP Behavior is set to Simple Only

PPP Settings
UM
[Only registered and activated users can see links]
[Only registered and activated users can see links]
password: vzw

AN
[Only registered and activated users can see links]
password: vzw


Last But not Least:

Run terminal from your p hone.
Should show a black screen.
type mpt x
exit terminal

[DankOfOwnage]

for some reason...the rom image won't combine

[ten0rplaya04]

Man is that a lot of data to run through...I'll try it on my Pixi sometime this week because the steps should be the same...I've been DYING to get terminal on the phone (or find 1.3.5.1 Doctor)

[drummerboy42]

Great Giude! much better then the others I have found. Thanks for sharing.

Its Updating to V.1.4.1.1 . Is that going to cause me any issues later?

[ownmart]

very nice write up If I ever get one of these phones in I'll definitely try it out

[Dex]

New Addys for Palm Pre


[hide-thanks]1.4
Read from 00a5c2aa length in bytes 1703639
spc found at offset 8024

WS addy 005a:006b


Pre with 1.4.1

075b:2721 one occurance

0759:4D56 second occurance

*edit*
Well i flashed a Pre today with new 1.4.1.1 that i created the spc was located at

00A6:42CE
[/hide-thanks]
hope this helps

[djskylink]

Great guide, thank you very much! I'm having one problem however. I've got my sprint palm pre on verizon and I've got phone, texts and 1x however I can't seem to get the EVDO working. I've followed all of those steps, but any time I hit ##evdo# and change it to hybrid rev a, it gives me the 67 error code (can't connect to data)

[Only registered and activated users can see links]

Edit: I think it's because I never changed the nv_item 9000, I'm on webos 1.4 and I can't figure out how to change that so it won't be constantly roaming. Any help would be very appreciated!

[nemogamo]

pls tell me, if this works on pixi's ?

[Dex]

yes it does BUT the spc locs are different

[rick1475]

Great Write up But what is the command to get the phone off Diag

[parin]

Thanks a lot for this guide

[happyjack]

I have a Palm Pre Plus. Would this procedure work for it.

[vijaymalhotra_2007]

how to connect palm pixi plus to Pc and how load the usb passthrough password?

[nusz]

New Addys for Palm Pre


[hide-thanks]1.4
Read from 00a5c2aa length in bytes 1703639
spc found at offset 8024

WS addy 005a:006b


Pre with 1.4.1

075b:2721 one occurance

0759:4D56 second occurance

*edit*
Well i flashed a Pre today with new 1.4.1.1 that i created the spc was located at

00A6:42CE
[/hide-thanks]
hope this helps

Hi,
I'm at Pre 1.4.5 is it the same location for the SPC Code?
And I have successfully connect the phone to QPST but can't access to memory part? which QPST apps should I use to access the memory? I'm using
QPST 2.7 build 373

[whitey10tc]

QPST isn't going to cut it. You will need WS to get to the memory locations and you might need to run a scan as the locations may change with the newer version.

[elisa191]

Hello,

In connection with the SPC Locations using 1.4.5

Open CDMA Workshop and com up to that port and then read the phone
Switch to the security tab and nder the SPC / User Lock scan using Universal, RAM Method.
For the Start address enter: 00A4 and for the End address enter:00A7

Sorry I didn't keep the actual location where I found it but if it helps I know it was between 00A6 and 00A7 however I
think that it changes locations with this build so an exact location probably wont help anyhow.

Hope this helps someone

Elisa191

[losergang_jot]

Link is DED plz Upload new Link for Sprint OS

[socal]

hello id like to try your method but i have a sprint palm pre which i want to flash to cricket can you reupload the file for the sprint modified webos doctor file or send me a alternative link to download it from the link you had is down not active anymore thank you

[Boooooommm]

The SPC is in MANY locations on the memory of the phone. Simply make a dump of readable memory with the program of your choice to a .bin (I like using DFS for this as I can read and scan the memory together from the same screen using their trial version) and skim through it using a hex editor (even Wordpad will do since you're looking for a 6 digit number string, not hex values). Then try out each 6 digit number you bump into to see which it is, although I'm pretty sure the first one you see is probably it. Trust me when I saw they are VERY EASY to spot. You shouldn't have any issues with it if you made it to root.

[azjim]

does any one have the 2 files for sprint link is dead thanks azjim