Finding the SPC on Sprint/US Cellular Blackberry's

[thesmitty68521]

I am copying and pasting this directly from Mobile Files. This is very useful in finding the SPC for the Blackberry. If this doesn't work, downgrade the OS on the Blackberry. Biglou23 has a post on this somewhere.

This is courtesy of Tonycortes from Mobile Files:

I've updated my guide, enjoy, larger ranges (takes a few more seconds to read, but higher success rate):

1) Install QXDM (2.08 Release Recommended)

2) Install Blackberry Desktop Manager (Should create two RIM Virtual Ports on PC)

3) Run Blackberry Desktop Manager the entire time (Device should show connected)

4) Using UniCDMA read MSL/SPC from the following:

Blackberry 8130 Pearl
Address: 0x106C0000 Length: 1703936
Address: 0x10130000 Length: 500000

Blackberry 8330 Curve
Address: 0x10700000 Length: 1703936

Blackberry 8703e
Address: 0x10050000 Length: 1703936

Blackberry 8800
Address: 0x10630000 Length: 1703936

Blackberry 8830 WE
Address: 0x10600000 Length: 500000

5) With WinHex (or equivalent HEX Editor) search for 6-digit code in the memory dump by using the GATHER TEXT feature in the SPECIALIST menu. Use this tool to filter out unnecessary characters. I recommend setting the GATHER TEXT feature to 6 succession, only numbers and have Unicode characters tolerated.

6) Once you obtain the SPC/MSL, exit UniCDMA and run QXDM.

7) Configure QPST (globe in system tray) and QXDM to the correct ports, phone must show detected.

8) Using QXDM (ensure VIEW is set to COMMAND OUTPUT) type the following commands:

a) mode offline-d
Turns radio off and sets to service mode. Check phone radio is off.

b) spc "******"
Replace asteriks with the 6 digit code. Output should read successful.

c) pr_list_wr 0 "C:\prl_1039.prl"
If needed change file path to location of PRL. Output should read successful.

d) nv_write sec_code {"000000"}
Optional: use this command to change code to zeros or another 6 digits.

e) mode reset
Reboots phone to reset mode.

9) Finally, through the phone type #4357* (#HELP*) to verify the PRL write.

##6digitMSL and SEND to start NAM Programming

NOTE: If PRL reverts (SPRINT), use QXDM command to read and disable NAM_LOCK:
a) nv_read nam_lock (should read enabled, which we'll change in the next command)
b) nv_write nam_lock 0 0 (disables)

Then proceed with UniPST and the RIM DLL to edit the registration ID (and List) to "2004"

note: i only ask that no one claims anything. by the way, reg id help goes credit to another member, i forgot his name, but you know who you are.

The only part where I do this differently is: To change the REG ID simply enter ##000000 + Send and go from there. Much easeir than Unipst. Once again, I didn't come up with this.

[user1]

any luck with curve 2 from ussc

[thesmitty68521]

What is the model number for that? Another way to do that is to do a scan on CDMA Workshop. That tells you the readable areas of the phone.

That and see if a carrier like verizon offers the same model and downgrade the OS to that one. It will allow you to find the SPC

[bawanyh]

Curve 2 I think you cannot downgrade there software is already upgraded and the downgrade on blackberry website is not available. Have you tried the calculator in the new CDMA Workshop? That might help. It doesn't help on sprint ones but I dont know about USSC.

Thanks

[k3rrsed]

I am working with a fellow that is attempting to develop an algorithm for Sprint SPCs based on ESN, so if you would like to assist us with developing a FREE solution for generating Sprint SPCs for newer BBs, please pm me your findings, or post them here wherever relevant.

[kc720]

to change bb reg id while flashing prl with qxdm :
1) mode offline-d
2) spc "000000"
3) nv_write_item 11055 0xD4 0x07
4) nv_write_item 11089 0x01 0xD4 0x07
5) mode reset