Flash Q9's to CricKet able to *228 and get EVDO

[Help]

DO NOT TRY THIS WITHOUT FIRST UNDERSTANDING THE RISKS (NO ONE WILL BE RESPONSIBLE FOR YOUR PHONE BUT YOU). A bricked (dead) phone is a real possibility. I bring this info only because my phone is so much more usable now. (Faster internet access and no more roaming problems.)
EDUCATE YOURSELF UNTIL YOU FEEL COMFORTABLE WITH THE RISKS AND THE PROCESSES - PROCEED AT YOU OWN RISK
( MAKE SURE you have a fully charged battery before flashing as a half charged battery CAN result in a BRICK)

Here is what you will need.
1. Download and unzip

a. RSD lite (4.2 works better on stuck phones)([Only registered and activated users can see links]) Link found on google...

b. RSD General. Link found here at CDMAgurus ([Only registered and activated users can see links])

c. Generic monsterfile for Q9c. Monsterfiles for the 9c & 9m are interchangeable, a monsterfile for any other model will likely brick the phone. ([Only registered and activated users can see links]])
Link from HelloMotoQ's WIKI
([Only registered and activated users can see links])
d. USCC (US Cellular) 6.1 wm update file for Q9c ([Only registered and activated users can see links]])
Link found on HelloMotoQ's WIKI...
([Only registered and activated users can see links])

f. ActiveSync or Windows Mobile Device Center ([Only registered and activated users can see links]) (I disable ActiveSync when I use either RSD program, by right clicking on the ActiveSync icon. Then going to connections and uncheck “allow USB connections” and “open ActiveSync when device connects”. Click OK to save)

g. Cricket PRL file (rla or .prl). I have used 1039, 1040 and 1042. They all work well. 1050 does not OTA, at least not here in south central Texas. ([Only registered and activated users can see links] also at howardforums [Only registered and activated users can see links]

h. You will need 7-Zip or somthing to extract the files you have just downloaded. ([Only registered and activated users can see links]) (WinRar...[Only registered and activated users can see links])

2. I suggest you get your MIN and MDM. You may not need this if all goes well. However it is easier to get it off an activated phone than from Cricket.
On an activated Q, type##073887* like you are making a call. Enter your spc for the “security code” (may be 000000) Click on ”User Activation” then “ Nam1” record your “MIN” a 10 digit number that looks like a phone number but is usually not and the “MDM” which is your 10 digit phone number.
Backup your phone (you will lose everything on the phone).PIM Backup.../[Only registered and activated users can see links]
Found in HellomotoQ downloads


3 If you understand and are comfortable with the risks and the processes…
Master Reset the phone.
Install HTC unlock and execute it or Application unlock the phone with these Register hacks….go to… HKEY_LOCAL_MACHINE\Security\Policies\Policies:
Change the DWORD named "1001" to 1
Change the DWORD named "1005" to 40
(Unlocking may not be necessary; I have flashed a few phones now, without unlocking, though it seems like a good idea)

4. Open RSD lite
Load & write the generic monsterfile.
To load a file into RSD lite, click on the small box with an underscore in it to the right of the file name box. Then navigate to the file you want to load. Click "Open” to load.
Press Start to write the file to the phone. This takes a while (for a monsterfile up to 10-25 min). Don’t mess with the phone while RSD is writing to it, until the final step, when RSD will ask you to manually restart the phone. If the phone won’t restart or is already booted, leave it connected and remove the battery for a moment and the phone should start to reboot. It may still be 2-5 mins more before you get the “finished pass” statement from RSD Lite.
Load then write USCC 6.1 update with RSD lite
Just like you did with the monsterfile
(If your Q got stuck in the “boot loop” or bootloader mode don’t panic. Just put the Q into flash mode (bootloader's) by removing the battery and depressing and holding the return and * buttons while reinserting the battery. Then do it again.

[Help]

5. Open RSD General
(I didn’t worry about it saying does not support this phone or did not parse matrix file…)
Click on “provisioning”
Check on the boxes (left of the blue lettering) PRL, EVDO, Mobile IP, and RTT data
Click “Read Phone” (This may take 5-7 mins depending on your computer and the version of RSD General you are using.)
Click on “PRL” (maroon or blue lettering)
Click “Open File” and navigate to the .rla or .prl file you have chosen
Click on “EVDO”.
[Only registered and activated users can see links]
cricket for all passwords.
Go to “Mobile IP” (click on the maroon or blue “Mobile IP”)
. For behavior select simple IP only
Initial Registration chose 1750
Registration Retries type 2
QC optimized dormant handoff checked
Mobile Node Authentication select RFC2002bis
MN_Authenticator enter 800100
DMU Public ID type 10
[Only registered and activated users can see links]
Reverse Tunneling checked

Now click on RTT Data
QNC chose Disabled
MDR select SO 33 (if available)
SCRM = yes
R_SCH = yes
Pocket = NO
Preferred chose RC3
Data…IS-707 SO
Primary DNS = 192.190.109.42
Secondary DNS = 192.190.109.43
Dial enter #777
[Only registered and activated users can see links]
PDC Password cricket
PAP/PPP all usernames and passwords are the same
MAKE SURE ALL IS CORECT BEFORE you write to phone
RSD General should tell you it was successful writing to the phone.
You should be able to OTA *228 or *22804 (if the phone has been activated)

If you still can’t make a call to OTA … then try this
Type ##073887* press green button like you are making a call
Enter 000000 for your security code (also called the SPC)
Click on “User Activation”
Click on “Nam1”
Edit your “MIN” (you found in step 1 g…usually not your phone number but 10 digits, and looks like a phone number)
Edit your “MDM” (your 10 digit phone number)
Now you should be able to talk and text

[Help]

6. Cricket WAP setting:
Now make sure ActiveSync shows the phone Connected
Download Q.zip (link found here on CDMAgurus....[Only registered and activated users can see links]) This file should be unzipped and the Q folder is to be placed in your C drive: not to any folder just C:
In the Q folder you have 3 important files rapiconfig.exe, Command Prompt and delete-n-set.xml
[Only registered and activated users can see links]
So 5055505050 will be replaced with your 10 digit phone number.
Click on file->save and close the notepad
Open the Command Prompt (the one inside the Q folder) and type after the “>” cd C:\Q and enter
Then the cursor will move down to the next line and you should see this C:\Q>

Type this in >rapiconfig.exe /p delete-n-set.xml (yes there is a space between exe and /p
So it should look like this C:\Q>rapiconfig.exe /p delete-n-set.xml). Now hit enter.
Then you will see “Config results written to output file RapiconfigOut.xml.”
“Config succeeded.”
You should be able to go to most any web site on the Q9 now.



7. MMS SETTINGS:
Load the phmregistry ([Only registered and activated users can see links]) into your phone and install. Click ok when it says “may not display properly because it was designed for previous version”, and click done
Go to Start and open PHM Registry Editor (on the phone)

Go to HKEY_LOCAL_MACHINE -> Software -> Motorola -> MMS -> Profiles

Now in Profiles you will see USCC MMS1 and USCC MMS2
Highlight and Delete USCC MMS2. by pressing Menu and chose Delete
Highlight and Rename USCC MMS1 to Crkt MMS by pressing Menu and choose Rename...
Highlight Crkt MMS, press values then you will see ActiveProfiles
Highlight and Delete ActiveProfiles and press done to save the changes, and then back arrow until “Crkt MMS”is highlighted
Click on "Crkt MMS." In here you won’t see anything until you press “Values”.
Then you should see the following:

Data Connections
Gateway
IP Address
Lock
MMSC URL
Port

Now choose “IP Address”. Set the “value data”to“10.3.0.41”. Make sure you hit “Done” to save the setting and then it will bring you back to the list above.

Choose “MMSC URL” and edit to read [Only registered and activated users can see links] and click done to save.

Choose “Port” and make sure it reads“8080” and click done to save

That’s it… you are done. Go to your home screen and restart your phone


I must inform you, none of these ideas are mine. Homage should be paid to all those who have given freely of their time and intellect to grant us, the freedom to use whatever phone we want on whatever network. These pioneers, if you will, beezlewaxin with his incredible work on the Wap settings: NfuryVIII, amoamare, and samsung415 and many others who I should remember, I give my humble appreciation. A job well done, yet many still explore for improvements, including you and me.

Educators call it cheating, We call it teamwork

[Help]

Don’t take this lightly, sometimes things go WRONG.
NO ONE WILL BE RESPONSIBLE FOR YOUR PHONE BUT YOU.

These links are not mine and do change sometimes. If any are dead, please PM me, but dont let that stop you.
Search this forum. Search Google. Search this custom PhoneTech search engine... [Only registered and activated users can see links]

Post If I can help. I'll get back to you as soon as I can.

Good luck, peace
Help

If you try this, drop a post and let us all know how it went. I hope all this makes it easier for you.
If it worked, how about clicking the THANKS button ( I need the Rep's).
If you find any of these Pioneers (beezewaxin, NfuryVIII, amoamare and others) give them thanks. They did the work.

[whitey10tc]

Good write up! You have a few links that are not working but good write up still.
They are in
D
F
and I
But good work and thank you for the contribution. Look forward to more like this.

[bigglou23]

Very nice write up, great job!

[Dex]

5. Open RSD General
(I didn’t worry about it saying does not support this phone or did not parse matrix file…)
Click on “provisioning”
Check on the boxes (left of the blue lettering) PRL, EVDO, Mobile IP, and RTT data
Click “Read Phone” (This may take 5-7 mins depending on your computer and the version of RSD General you are using.)
Click on “PRL” (maroon or blue lettering)
Click “Open File” and navigate to the .rla or .prl file you have chosen
Click on “EVDO”.
[Only registered and activated users can see links]
cricket for all passwords.
Go to “Mobile IP” (click on the maroon or blue “Mobile IP”)
. For behavior select simple IP only
Initial Registration chose 1750
Registration Retries type 2
QC optimized dormant handoff checked
Mobile Node Authentication select RFC2002bis
MN_Authenticator enter 800100
DMU Public ID type 10
[Only registered and activated users can see links]
Reverse Tunneling checked

Now click on RTT Data
QNC chose Disabled
MDR select SO 33 (if available)
SCRM = yes
R_SCH = yes
Pocket = NO
Preferred chose RC3
Data…IS-707 SO
Primary DNS = 192.190.109.42
Secondary DNS = 192.190.109.43
Dial enter #777
[Only registered and activated users can see links]
PDC Password cricket
PAP/PPP all usernames and passwords are the same
MAKE SURE ALL IS CORECT BEFORE you write to phone
RSD General should tell you it was successful writing to the phone.
You should be able to OTA *228 or *22804 (if the phone has been activated)

If you still can’t make a call to OTA … then try this
Type ##073887* press green button like you are making a call
Enter 000000 for your security code (also called the SPC)
Click on “User Activation”
Click on “Nam1”
Edit your “MIN” (you found in step 1 g…usually not your phone number but 10 digits, and looks like a phone number)
Edit your “MDM” (your 10 digit phone number)
Now you should be able to talk and text


Last time i checked RSD General wont allow those settings to write to the fone on the MIP settings pages it says the values are not supported please correct me if im wrong but from what i have experienced flashing Q and Q9's thats what i get

[Help]

Thanks for your input. That is what these forums are all about, POOLING OUR KNOWLEDGE.
I noticed when I have read the phones, after flashing, that some the settings don't stick (the MIP settings, I believe, do). So there may be some over kill in this tutorial. But I know it works. At least now with RSD 5.2.9 that we can read the phone. I'll try to do that the next time I flash a Q9. If you can help weed out any stuff that is not needed, I would be grateful. (The tutorial will work for the "Classic Q's" But in #5 section , you only need to set the “Mobile IP Behavior” choose “Simple IP Only”. They don't use the other settings in that section. And of course use ONLY Classic Q firmware)
If you have $$$ software like CDMAworkshop ect. Q9's can be flashed in less time and with less effort. (The Generic Monster is just a way of resetting the SPC\MSL,)
To do this, No Special Flashing Knowledge is Needed. No HW Virtual Serial Port to mess with.
You don't have to buy anything, just read, download and flash. This is really more of a noob way of getting EVDO and *228 ota (Over The Air) programming.

I look forward to your to your continued input.

[techcompsolutions]

Please FEEL free to add this to your beginning post BUT on all PHONES ESPECIALLY THE Q or Q9's MAKE SURE you have a fully charged battery before flashing as a half charged battery CAN result in a BRICK :)

[Help]

Please FEEL free to add this to your beginning post BUT on all PHONES ESPECIALLY THE Q or Q9's MAKE SURE you have a fully charged battery before flashing as a half charged battery CAN result in a BRICK :)
I have flash several Q's n Q9s with only half charges. Never had a problem, but I'm sure in depends on the battery (what kind of shape it is in).
An Excellent Suggestion. Thanks added to the first post.

[marksalone2010]

I need some help please, htc unlock says access denied when i try to write the new values and rsdlite fails every time any thoughts?

[gdemi]

Thanks for your input. That is what these forums are all about, POOLING OUR KNOWLEDGE.
I noticed when I have read the phones, after flashing, that some the settings don't stick (the MIP settings, I believe, do). So there may be some over kill in this tutorial. But I know it works. At least now with RSD 5.2.9 that we can read the phone. I'll try to do that the next time I flash a Q9. If you can help weed out any stuff that is not needed, I would be grateful. (The tutorial will work for the "Classic Q's" But in #5 section , you only need to set the “Mobile IP Behavior” choose “Simple IP Only”. They don't use the other settings in that section. And of course use ONLY Classic Q firmware)
If you have $$$ software like CDMAworkshop ect. Q9's can be flashed in less time and with less effort. (The Generic Monster is just a way of resetting the SPC\MSL,)
To do this, No Special Flashing Knowledge is Needed. No HW Virtual Serial Port to mess with.
You don't have to buy anything, just read, download and flash. This is really more of a noob way of getting EVDO and *228 ota (Over The Air) programming.

I look forward to your to your continued input.

Earlier this year I flashed about thirty q9's to Cricket - I found no matter what I tried, *228 would never work - always get unable to program (I am in Phoenix Area) . Virtually all the other phones I program work with *228, I usually just load PRL 1040 and set the sid to 4923 and they OTA, . Starting about September of this year I just happened to try *228 on a Q9 and it worked!, Since then I have done maybe 10 more q9's and they all worked with *228.

I think Cricket must have done something to their OTA system in the last few months to fix this.

Furthermore I have always used the Verizon Monster Pack WM 6.0 full and then 6.1 upgrade. Even the Sprint Q9's work with the VZW MP (except two keys reversed). Loading this MP, resets the SPC to 000000 (along with certain other parts of the NAM including PRL and I believe MDN/MIN) by loading the 6.0 VZW MP.

EVDO seems to work properly without all the manual settings suggested for NAM/MIP etc.

Using INsainecain's QCKTMMS.CAB (google it) eliminates virtually all the MMS setup, just run the cab and reboot.

I appreciate your work on this, just trying to make things a little simpler and easier.

[gdemi]

The only big problem I have with Q/Q9's now is when people change their phone number, I have to tell them to rbing it back to me so I can run rapiconfig from a computer. QCKTMMS.CAB is already on the phone so I dont have to change it - just rerun it.

It seems it would be a simple registry mod to change the phone number of the Cricket connection set up by Rapiconfig. I haven't had the time to see if this is possible or to re-write rapiconfig as a CAB file.

Can anyone point me to the lines in the rapiconfig XML file that cause the MDN to be stored in the Registry?

Then I could do a little one page writeup for the customer that shows them how to get WAP/MMS back working if they change their phone number.

[rich hathaway]

if you are counting from the top line 19 is the one that holds the user name with the mdn,however if what you want is the one that comands it,it is --
nocharacteristic type="CM_PPPEntries" /> third from the top as a list,second from the top from the commands.

but just open that file and you can see it for yourself.