Virgin Mobile USA working data/mms/3g settings discovery thread

[idone]

Purpose of this thread is to obtain a working set of mms/1x/evdo/wap etc.. settings for VM phones used on the US marked. UK CA etc etc settings need not apply this is for virginmobileusa.com cdma phones.

VM US seems to be one of the only carriers out there that don't have a good working set of settings available. One would assume that with rootable intercept handsets out there good settings would have already been dumped and made public.


Some older info's for VM US market that were posted to the web 6+ months ago


MMS:
Digital Album Address: *PIC
Digital Album Title: Upload to My Pix
MMS Server Name: 205.239.233.136:81
User Agent Profile URL: [Only registered and activated users can see links]
User Agent: KX5
MMS Host URI: mmsc.vmobl.com:8088
MMS Post URI: [Only registered and activated users can see links]

____________________________________
SIMPLE IP:
[Only registered and activated users can see links]
Default PPP Password:

____________________________________
DATA:
Phone Homepage URL: [Only registered and activated users can see links]
Packet Dial String: #777

_____________________________________
NAI Profile 0:
[Only registered and activated users can see links]
Set MN_HA_SPI: True
MN HA SPI: 8687
Set MN AAA SPI: True
MN AAA SPI: 8687
RT Preference: On
Home Address 0.0.0.0
Primry HAA: 0.0.0.0
Secondary HAA: 0.0.0.0
MN HA SS: vmug33k
MN AAA SS: UEbd1XF3GD
MN Authenticator DMU:

_________________________________
Browser:
Server A Primary URL: 205.239.233.136
Server B Primary URL:
Server A Secondary URL: 205.239.233.136
Server B Secondary URL:
User Agent Profile URL: [Only registered and activated users can see links]
HTTP Password:


APN backup from stock VM intercept


<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
- <apns count="1">
<apn name="Virgin Mobile" numeric="31000" mcc="310" mnc="00" apn="Sprint" user="Sprint" server="*" password="*" proxy="null" port="null" mmsproxy="205.239.233.136" mmsport="81" mmsprotocol="null" mmsc="[Only registered and activated users can see links]" type="null" />
</apns>


[Only registered and activated users can see links]

Will try to get some more info together by tonight to expand this post/thread.


Please refrain from spamming this thread with OT BS.


*****edit*****

.prl 40412 from VM broadband2go modem. ([Only registered and activated users can see links])

[Wrecked Johnson]

So what exactly does this have to do with the EVO? I think you posted in the wrong section friend.

[idone]

Going to internet on a stock VM Kyocera loft goes to:


[Only registered and activated users can see links]

User agent profile for this unit is


[Only registered and activated users can see links]

[idone]

So what exactly does this have to do with the EVO? I think you posted in the wrong section friend.

My intention was to get working settings for android phones and specifically the EVO but if this thread could get more attention and fits properly elsewhere my feelings wouldn't be hurt if a mod moved it for me. ;)

I'm starting to think having a proper user agent for wap is one of the major hurtles that is keeping people from getting this working.

Hopefully others take interest I'm a noob to cdma but was a service manager and tech trainer for Nextel for 2+ yrs (pre-sprint merger) so not new to the business just to cdma.

[idone]

HERE ([Only registered and activated users can see links]) are some apps from a stock VM intercept. included are :

Android_VirginUS-Chat.apk
apns-conf.xml
Mms.apk
Mms.odex
Virgin_Mobile.apk

Sadly I think we will require the one for the browser as well, if you get it before me please link it here for everyone to benefit.


***** edit*****
There is a wiki HERE ([Only registered and activated users can see links]) stating some things already tried on a stock intercept upgraded to sprint froyo2.2 to get their VM US settings back up and working.

The resolution for this android handset will likely be 100% relevant to the resolution needed for all android based cdma handsets. And their previous attempts to get correct settings can save us time in our search for a fix.

[idone]

More useragent profiles for VM phones


[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]
[Only registered and activated users can see links]

[Wrecked Johnson]

nice, if your doing this as a noob would love to see what you get going later.

[k12k08]

Any updates on this subject?

[idone]

^^^

There are some full system dumps of a VMU intercept. I've been looking and comparing with system dumps from the sprint branded intercept to try and get to the root of the settings issue.

If you or anyone else with an active VMU intercept has a small bit of time they can spare there are a some things you can do to help this along.

Also anyone with a cheap/broken/liquid damaged intercept I'm likely interested to purchase it from you to help this along.

Feel free to get in contact if so.

[protow]

i dont have the intercept but should have it here soon. i do have the loft. (i know that wont help) but im willing to anyway i can

[idone]

protow is your phone here yet?

[typh]

I have a VMU intercept. I've been trying to get it connected to cdma workshop or QPST. I flashed Sprint rom so I can connect, but I haven't been able to read any of the NV items. If anyone knows how, or if I can help in some other way, let me know.

[idone]

Have you sent the spc/msl code first?

I am 95% sure it must be sent before your nv items can be read.

[typh]

I sent the default samsung password and the spc/msl, and I still can't get any of the nv items.

[firefly2004]

Nice thread,any more discoveries?

Thanks for the hard work.

[jamesb0n07]

this is 1192 nv items which I found but I am still missing 466 nv items. In order to get the data working, You need to get aaa codes from the donor phone which is unique for each phone. If anybody here needs 465 and 1194 NV items then please let me know so I can post it here.

[NV Items]
[Complete items - 1]

1192 (0x04A8) - OK
0A 44 62 74 43 43 54 5A 44 57 37 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[dj_peoples]

just successfully activated a sprint samsung moment on to vmu, only talk and yexy so far though. im trying to work out internet for it still.

[overthatscreen]

I've got an Optimus V. I plan on rooting it later tonight. Just tell me what and how and I'll try my best to help out. Would love to see the Evo on Virgin Mobile USA.

[highlandsguy]

Yeah, post all of the non-unique to phone nv items: 465 and 1194 (if they are not phone specific). Which has the AAA key, since it is specific, right?

[NP08]

I've got an Optimus V. I plan on rooting it later tonight. Just tell me what and how and I'll try my best to help out. Would love to see the Evo on Virgin Mobile USA.

My Optimus V arrived today, and I'll snoop it to see what it says as far as Internet & other settings.

EDIT
There is a huge 3G connection problem on these when Android gets updated to 2.2. My research here is to help alleviate that problem on the Optimus V. :)

[24861]

I got my HTC Evo Shift up and running on Virgin...... but still trying to iron out the 3G. Anyone know bwhere I can find some help?

[NP08]

Only thing I can't find are the locations for the profile HA/AAA keys. QPST won't fully read the phone (but does bring up two profiles). It won't accept the QXDM read user profile command. Any ideas?

[NP08]

Yeah, post all of the non-unique to phone nv items: 465 and 1194 (if they are not phone specific). Which has the AAA key, since it is specific, right?

The 1194 on my Optimus V has 62 contiguous pairs of hex data, the rest are zeroes. 465 doesn't have much:


00465 (0x01D1) - OK
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 01 03 00 00 00 01
02 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[NP08]

Since I don't see another way to get the AAA PW, I've gone through the NV Items file I downloaded out of the Optimus V tonight. It was a 300 page long txt file! I looked for 4~30 character strings in the items near the beginnings of the items. I've narrowed it down to 3 pages, and will look for some likely candidates and try them out one at a time. As far as I can tell, the Samsung Intercept according to this thread ([Only registered and activated users can see links]) here on VM uses vmug33k for the HA PW (see post #6). For the AAA, he used a data log (logcat) to recover the AAA PW. I found this didn't work on the Optimus V- or maybe I wasn't doing it correctly- the process is different from the Intercept to the Optimus. I'll update if I get any results.

EDIT
Using past examples, I found that the Intercept on VM used a 12 digit text AAA PW, which would be 24 in hex (2 hex for one text character). I put in vmug33k as a user profile 1 text field in M.IP using QPST in another phone that QXDM can read user profiles on, and it returned a hex of 76 6D 75 67 33 33 6B. It appears to be basic encryption (note the consistency for "3" below), where:
76= v
6D= m
75= u
67= g
33= 3
33= 3
6B= k

Looking at my thinned-down NV ITEM file, there is only one 24 hex entry, and it's item 215 located at 0X00D7. The format is similar to other phones I've seen, it's preceded by a 00 in item 215.

That's my best guess for now. I don't have signal to test it here, but will do so later & update. Apparently the system locks you out for too many incorrect PW attempts, but it's only for 20-30 minutes each time.

UPDATE
QPST wouldn't allow a 24 character entry in M.IP, so I tried a couple of 16 character ones all with the HA of vmug33k. Still no luck. I tried to read the NAM1 A-key in CDMA WS but it didn't find anything.

[mrdodge]

Any updates with regards to progress? I've also tried to read the AAA using logcat... with Anycut pointing to the DATA, since ##DATA# doesn't work for the Optimus V. I had to use the second one labeled "DATA" as my shortcut, since the first one was a blank screen. But no luck getting anything useful from the logs.

Anyway, please update with progress and I will do same.

Thanks,
md


Since I don't see another way to get the AAA PW, I've gone through the NV Items file I downloaded out of the Optimus V tonight. It was a 300 page long txt file! I looked for 4~30 character strings in the items near the beginnings of the items. I've narrowed it down to 3 pages, and will look for some likely candidates and try them out one at a time. As far as I can tell, the Samsung Intercept according to this thread ([Only registered and activated users can see links]) here on VM uses vmug33k for the HA PW (see post #6). For the AAA, he used a data log (logcat) to recover the AAA PW. I found this didn't work on the Optimus V- or maybe I wasn't doing it correctly- the process is different from the Intercept to the Optimus. I'll update if I get any results.

EDIT
Using past examples, I found that the Intercept on VM used a 12 digit text AAA PW, which would be 24 in hex (2 hex for one text character). I put in vmug33k as a user profile 1 text field in M.IP using QPST in another phone that QXDM can read user profiles on, and it returned a hex of 76 6D 75 67 33 33 6B. It appears to be basic encryption (note the consistency for "3" below), where:
76= v
6D= m
75= u
67= g
33= 3
33= 3
6B= k

Looking at my thinned-down NV ITEM file, there is only one 24 hex entry, and it's item 215 located at 0X00D7. The format is similar to other phones I've seen, it's preceded by a 00 in item 215.

That's my best guess for now. I don't have signal to test it here, but will do so later & update. Apparently the system locks you out for too many incorrect PW attempts, but it's only for 20-30 minutes each time.

UPDATE
QPST wouldn't allow a 24 character entry in M.IP, so I tried a couple of 16 character ones all with the HA of vmug33k. Still no luck. I tried to read the NAM1 A-key in CDMA WS but it didn't find anything.

[NP08]

I ended up giving up on it after not making any progress & sold the phone. I used the Anycut both in range & out of range of 3G, thinking that made a difference, but it didn't. The phone is someone else's problem now.

[atchoufong]

If you own a samsung intercept, the AAA password is in item 466_1. I have found mine, but still can't get 3G. I am probably missing a setting. [Only registered and activated users can see links] by alexanderkr1

[idone]

Motorola Triumph won't let you read the nv item that contains aaa_pw. Internet searches turned up zero also so I will post how I got it. Get your spc/msl code Install anycut/bettercut Make a shortcut to the activity>DbgCfgTool and also Select COM Port Mode (com port mode can also be accessed via ##port# from the dialer. In DbgCfgTool go 2-Logger Conf and enable dump system info in 4-Modem Conf "Ram Dump Configurations" change it to Auto Download. save your settings as you go and then go change your com port from mass storage to diag. Reboot your phone(this is mandatory for your DbgCfgTool settings to save their changes) Now I use cdmaworkshop 2.7 that is widely available on the internet to trigger a ram dump. Go to computer management>devices on your windows pc, look under ports to see which port your phone is on enter this port in cdmaworkshop and click connect. Go to security tab and enter your spc then click send. now click scan memory... it will fail, but look at your phone it is dumping ram to your sd card transfer this file to your pc as soon as your phone reboots. Throw it in your favorite hex editor and search for the ha password or your hexadecimal meid... your aaa password will be found multiple times and will appear just as in the picture atchoufong posted. It will ALWAYS be 10 characters long and can consist of uppercase, lowercase, symbols, and numbers. Good luck and have fun guys.

[idone]

Using past examples, I found that the Intercept on VM used a 12 digit text AAA PW, which would be 24 in hex (2 hex for one text character). I put in vmug33k as a user profile 1 text field in M.IP using QPST in another phone that QXDM can read user profiles on, and it returned a hex of 76 6D 75 67 33 33 6B. It appears to be basic encryption (note the consistency for "3" below), where:
76= v
6D= m
75= u
67= g
33= 3
33= 3
6B= k

.

I just wanted to point out so no one gets confused the aaa password will always be 10 characters not 12. vmug33k is still good and current for ha_pw. And lastly that's not any form of encryption those are that hexadecimal representations of those letters XD

[ykman1]

Any clue on how to get the keys from a LG Rumor yet? I've searched everywhere and even made post on various sites and I'm not getting any answers. All I keep seeing is that its impossible to get the keys from a rumor? Anybody have any ideas???&nbsp;

[elcidroyale]

I found this on another website:

But then I found that for the Intercept you can easily read the AAA shared secret using logcat.

Here's how...

Prereqs: adb and usb debugging and MSL

1. Go back to ##PORT# and change the second option back to PDA so you can use usb debugging.
2. Install Any Cut and create a shortcut for DATA (choose the 2nd DATA in the list - it should allow you to Edit)
3. Connect your phone to usb ( #8778# USB must be in PDA mode & debugging on)) and from the terminal (or command line)
type: adb logcat > logcat.txt
4. Then using the shortcut you created on your phone with Any Cut - hit edit and edit your username but don't change anything.
5. Then Ctrl-C on your logcat screen.
6. Look through the logcat.txt file for "aaa_pw:" and "ha_pw:"
They should be there.

It worked perfectly for me. I used a Sprint phone and put it on Platinumtel. Calls, SMS and 3G web work perfectly! Hope this helps..

Sent from my SPH-D710 using Tapatalk

[BOODA3000]

I currently have a Nexus S that's programmed for Pageplus. I only get 1X data speeds.
What changes do I need to make to the Nexus S to get it working with PlatinumTel?
I'd really like to use them!

Thanks,

[insink71]

what I was speaking about is swapping... sorry I used the word "clone" but as I stated before I'm new to cdma... I will refer you to this post that I will use in case someone decides to prosecute me for talking about possibly swapping esn's of two phones I own... I sm not attempting to defraud anyone; therefore, it is not illegal.
[Only registered and activated users can see links]
Also, I have court decision documentation which favors the consumer... but alas, ban away, as I will be going back to gsm where I can easily pull my sim and switch to the phone of my choice. No wonder Google dropped support for CDMA.. carriers think they rule the world and forums like this cow to them. Most certainly I'd be breaking TOS with some cdma carrier or another, but alas, that is s far cry from breaking the law. So jump on a new poster if you wish, but don't bring legality into it unless you want are well-versed and ready to prosecute... it makes the casual noob feel like reading libel law for tarnishing his reputation. So, thanks, sorry I used the wrong verb, and in conclusion, I respectfully disagree.

Rob

Sent from my marvelc using Tapatalk

[whitey10tc]

Nice was thinking of cloning my HTC Wildfire S (on Virgin Mobile) and feeding it into my Evo 4g. I do have a purchased cdma workshop, but I being a bit new to the cdma side, I am proceeding slowly and with caution.

Rob

Sent from my HTC_A510c using TapatalkWe do not discuss illegal actions such as CLONING on the public forums. This will be the only warning. Any further illegal discussions of cloning will result in bans being issued and threads removed.

[anitascorpion]

what I was speaking about is swapping... sorry I used the word "clone" but as I stated before I'm new to cdma... I will refer you to this post that I will use in case someone decides to prosecute me for talking about possibly swapping esn's of two phones I own... I sm not attempting to defraud anyone; therefore, it is not illegal.
xda-developers - View Single Post - esn change legality? ([Only registered and activated users can see links])
Also, I have court decision documentation which favors the consumer... but alas, ban away, as I will be going back to gsm where I can easily pull my sim and switch to the phone of my choice. No wonder Google dropped support for CDMA.. carriers think they rule the world and forums like this cow to them. Most certainly I'd be breaking TOS with some cdma carrier or another, but alas, that is s far cry from breaking the law. So jump on a new poster if you wish, but don't bring legality into it unless you want are well-versed and ready to prosecute... it makes the casual noob feel like reading libel law for tarnishing his reputation. So, thanks, sorry I used the wrong verb, and in conclusion, I respectfully disagree.

Rob

Sent from my marvelc using Tapatalk







I am having HTC wirldfire S virgin mobile and I replaced the PRL file with a new PRL and I am able to see the correct prl version in settings but there is no network at all.

The same new prl is working with Verizon mobile.


In my settings ->about-> network->

no operator name is there, signal length is 0, mobile network type is unknown,service state : out of service, Roaming: not Roaming.

So please help me I did all the described steps to replace the PRL.