How to FLASH MIFI 2200 debrand and Bypass Data Filters

[rich hathaway]

the fact is no one outside of vzw engineering knows exactly how and when,so pointing fingers is useless and a waste of space,so why do you guys spend your energy helping with a solution instead of that.carriers change things all the time,some more than others,(look at apple) hackers have cost them millions in labor and engineering,its just the way it is that carriers find the exploits we use and close them so we must look for new ways to achieve our goals,but no one that comes into this thread wants to read all this bs thats in between the useful posts,its just a turn off to our members and our guests.

lets get this thread back on track guys..

[80sbaby]

My curiosity is what video are you referring too? Is it the howto flash and bypass activations video? The one published on May 12? Long after all this started? I know of mifis that were starting to go down back in the last week of April and first week of May. S I'm guessing that you feel that by him publishing that video on May 12, 2013 that Verizon was able to see into the near future on April 27, 2013 and start shutting down Mifis? God I wish I could see the future like that.
I know the exact date my first Mifi went down it was 4/27 the next was 5/3 and saw reports on the 5th and 8th on facebook. Maybe I'm wrong but it looks like the problem started before a video was made and the video was made to help solve the problem?

the video you are referring to is by no means the one i am referring to other flashers know the one im talking bout actually there was two he made them like a month ago he was explaing what .....s were used what plans were used the whole process describing the akeys and ha/aaa keys and claiming most flashers to be scammers and in a scene narrowing him self down as almost the only legit flasher etc

[GrumpyOldFar]

Actually the first ones started going down before the 27th. Whether his video did or did not do any harm is up for discussion. The fact remains the less that verizon or any carrier knows the better off everyone is. So lets put the blame on everyone that sells Flashed Mifi's on ebay or flashing service's.

I may be a Newb on here..but I am far from that. Also, Elisa191 I probably have as many certs as you do or maybe more but that did not help me when my Mifi went down and I do not brag about it to make me look good or make everyone else look bad. I am a 67 year old retired hacker and I own several by invite only forums. But, unlike you I let my reputation be my advertizing. Take my advise and let your customers do your advertising...If you offer a quality service at a reasonable price..they will come!

[thepabster]

Just a few points. First, units were clicked off well before May. I know a whole bunch were down by April 25. Just saying.

Second, flashing is always an art not a science. If you think for one minute Big Red didn't know what was going on you are a fool. And they don't require any videos or discussion threads to realize it. Red employs a team of highly sophisticated people making A LOT of money. They know exactly what is happening, when, and how. And if they are told to stop it, they will. It's that simple. My guess is the extra income was outweighed by the load on the network and the explosion of people selling these devices and services certainly exacerbated that. All good things come to an end, and this has. I think we should leave it at that.

Personal attacks and such do absolutely nothing. If there's one thing for certain, if Red were watching, they are laughing their rears off. Let's continue to report our findings and observations and anything which might benefit the community at large. And that's something we can all benefit from, regardless of our expertise or training.

[whitey10tc]

the video you are referring to is by no means the one i am referring to other flashers know the one im talking bout actually there was two he made them like a month ago he was explaing what .....s were used what plans were used the whole process describing the akeys and ha/aaa keys and claiming most flashers to be scammers and in a scene narrowing him self down as almost the only legit flasher etc

I asked because the only video I can find is the one from the 12th.

Actually the first ones started going down before the 27th. Whether his video did or did not do any harm is up for discussion. The fact remains the less that verizon or any carrier knows the better off everyone is. So lets put the blame on everyone that sells Flashed Mifi's on ebay or flashing service's.

I may be a Newb on here..but I am far from that. Also, Elisa191 I probably have as many certs as you do or maybe more but that did not help me when my Mifi went down and I do not brag about it to make me look good or make everyone else look bad. I am a 67 year old retired hacker and I own several by invite only forums. But, unlike you I let my reputation be my advertizing. Take my advise and let your customers do your advertising...If you offer a quality service at a reasonable price..they will come!

I beleive it when you say before the 27th, I just know that was when my first one went down on the 27th.

[rich hathaway]

you guys that think that vzw saw a utube vid and went "omg people have illegally put mifi's on our network" are just funny.

here is how they know everything about what you are doing and what device you are using



Decoded signal unit THIS IS THE MESSAGE FROM THE SMSC TO THE SWITCH, WHICH GETS DELIVERED TO

THE PHONE

--------------------------------------------------------------------------------
# User:
# Date:
# Octets: 118
--------------------------------------------------------------------------------
Octet001 ANSI SS7 Count=000001 Time=
--------------------------------------------------------------------------------
10100011 BIB/BSN (163) 1/35
10000001 FIB/FSN (129) 1/1
..111111 SU type/length (63) MSU63
00...... Spare 0
--------------------------------------------------------------------------------
Octet004 Service information octet
--------------------------------------------------------------------------------
....0011 Service indicator (3) SCCP Signalling Connection Control Part
..01.... Message priority 1
10...... Network indicator (2) N National network
--------------------------------------------------------------------------------
Octet005 Routing label
--------------------------------------------------------------------------------
........ DPC: Net-Clstr-Mbr 00X-XXX-XXX MSC
........ OPC: Net-Clstr-Mbr XXX-XXX-XXX SMSC
01011100 SLS 92
--------------------------------------------------------------------------------
Octet012 Message type
--------------------------------------------------------------------------------
00001001 Message type (9) UDT Unitdata
--------------------------------------------------------------------------------
Octet013 SCCP Protocol Class parameter
--------------------------------------------------------------------------------
....0000 Protocol class (0) Class 0
0000.... Message handling (0) Discard message on error
00000011 Ptr -> Called number 3
00001000 Ptr -> Calling # 8
00001101 Pointer -> Data 13
--------------------------------------------------------------------------------
Octet017 SCCP Called Party Address parameter
--------------------------------------------------------------------------------
00000101 Parameter length 5
.......1 Subsystem # bit (1) SSN present
......1. Sgnl pt code bit (1) SPC present
..0000.. Global title ind (0) No global title included
.1...... Routing bit (1) DPC and SSN based routing
1....... Natl Intnatl bit (1) National address
00000101 Subsystem number (5) MAP Mobile Application Part
........ Point code MSC
--------------------------------------------------------------------------------
Octet023 SCCP Calling Party Address parameter
--------------------------------------------------------------------------------
00000101 Parameter length 5
.......1 Subsystem # bit (1) SSN present
......1. Sgnl pt code bit (1) SPC present
..0000.. Global title ind (0) No global title included
.1...... Routing bit (1) DPC and SSN based routing
1....... Natl Intnatl bit (1) National address
00001011 Subsystem number (11) IS41 IS41D2000
........ Point code SMSC
--------------------------------------------------------------------------------
Octet029 SCCP Data parameter
--------------------------------------------------------------------------------
01011001 Parameter length 89
11100010 Tag (226) QRY W Query with permission, constructor, private use
01010111 Length 87
--------------------------------------------------------------------------------
Octet032 TCAP Transaction ID
--------------------------------------------------------------------------------
...00111 Tag (7) TCAP Transaction ID
110..... Class and form (6) Private use, primitive
00000100 Length 4
........ Originating ID XXXXXXXXXX
--------------------------------------------------------------------------------
Octet038 TCAP Component Sequence
--------------------------------------------------------------------------------
...01000 Tag (8) TCAP Component Sequence
111..... Class and form (7) Private use, constructor
01001111 Length 79
--------------------------------------------------------------------------------
Octet040 Invoke component
--------------------------------------------------------------------------------
...01001 Tag (9) Invoke component
111..... Class and form (7) Private use, constructor
01001101 Length 77
--------------------------------------------------------------------------------
Octet042 TCAP Component ID
--------------------------------------------------------------------------------
...01111 Tag (15) TCAP Component ID
110..... Class and form (6) Private use, primitive
00000001 Length 1
00000000 Invoke ID 00
--------------------------------------------------------------------------------
Octet045 Private TCAP Op Code
--------------------------------------------------------------------------------
...10001 Tag (17) Private TCAP Op Code
110..... Class and form (6) Private use, primitive
00000010 Length 2
.0001001 Operation Family (9) IS-41
0....... Reply Expected 0
00110101 Operation Specifier (53) SMSDelptpt SMS Delivery Point To Point
--------------------------------------------------------------------------------
Octet049 Parameter
--------------------------------------------------------------------------------
...10010 Tag (18) Parameter Set
111..... Class and form (7) Private use, constructor
01000100 Length 68
--------------------------------------------------------------------------------
Octet051 IS-41 SMS_Bearer Data
--------------------------------------------------------------------------------
...11111 Tag (31) Extended tag
100..... Class and form (4) Context-specific, primitive
........ Extended tag (105) IS-41 SMS Bearer Data
00011111 Length 31
--------------------------------------------------------------------------------
Octet054 Message Identifier
--------------------------------------------------------------------------------
00000000 Subparameter Id (0) Message Identifier
00000011 Length 3
0001.... Message type (1) Deliver (mobile-terminated only)
........ Message identifier XXXXXXXX
........ Reserved 0
--------------------------------------------------------------------------------
Octet059 Message Center Time Stamp
--------------------------------------------------------------------------------
00000011 Subparameter Id (3) Message Center Time Stamp
00000110 Length X
00010001 Year XX
00000110 Month XX
00010111 Day XX
00010110 Hours XX
01000011 Minutes XX
01000011 Seconds XX
--------------------------------------------------------------------------------
Octet067 Priority Indicator
--------------------------------------------------------------------------------
00001000 Subparameter Id (8) Priority Indicator
00000001 Length 1
..000000 Reserved 0
00...... Priority (0) Normal
--------------------------------------------------------------------------------
Octet070 User Data
--------------------------------------------------------------------------------
00000001 Subparameter Id (1) User Data
00001101 Length 13
00011... Message encoding (3) IA5 (Table 11 of ITU-T T.50)
........ Number fields 12
........ IA5 Char Tjatjatjatja
........ Reserved 0 0 0
--------------------------------------------------------------------------------
Octet085 IS-41 SMS_Teleservice Identifier
--------------------------------------------------------------------------------
...11111 Tag (31) Extended tag
100..... Class and form (4) Context-specific, primitive
........ Extended tag (116) IS-41 SMS Teleservice Identifier
00000010 Parameter length 2
........ Teleservice ID (4098) CDMA Cellular Messaging Teleservice
--------------------------------------------------------------------------------
Octet090 IS-41 Electronic Serial Number
--------------------------------------------------------------------------------
...01001 Tag (9) IS-41 Electronic Serial Number
100..... Class and form (4) Context-specific, primitive
00000100 Parameter length 4
10000000 Manufacturer's Code XXX
........ Serial Number XXXXXXX
--------------------------------------------------------------------------------
Octet096 IS-41 Mobile Identification Number
--------------------------------------------------------------------------------
...01000 Tag (8) IS-41 Mobile Identification Number
100..... Class and form (4) Context-specific, primitive
00000101 Parameter length 5
........ Digit(s) XXXXXXXXXX
--------------------------------------------------------------------------------
Octet103 IS-41 SMS_Charge Indicator
--------------------------------------------------------------------------------
...11111 Tag (31) Extended tag
100..... Class and form (4) Context-specific, primitive
........ Extended tag (106) IS-41 SMS Charge Indicator
00000001 Parameter length 1
00000010 charge indicator (2) Charge original originator
--------------------------------------------------------------------------------
Octet107 IS-41 SMS_Original Originating Address
--------------------------------------------------------------------------------
...11111 Tag (31) Extended tag
100..... Class and form (4) Context-specific, primitive
........ Extended tag (112) IS-41 SMS Original Originating Address
00001001 Parameter length 9
00000000 Type of digits (0) Not used
.......0 Natl Intnatl bit (0) International
......0. Presentation? (0) Allowed
.....0.. Number (0) Available
....0... Reserved 0
..00.... Provided (0) User provided, not screened
00...... Reserved 0
....0001 Encoding scheme (1) BCD
0010.... Numbering plan (2) Telephony numbering
00001010 Number of digits 10
........ address YYYYYYYYY
--------------------------------------------------------------------------------
Checksum CRC16................ 0000000000000000 hex=0000
--------------------------------------------------------------------------------


Decoded signal unit RESPONSE MESSAGE - THIS IS THE SWITCH TELLING THE SMSC THAT THE MESSAGE

WAS DELIVERED.

# User:
# Date:
# Octets: 43

--------------------------------------------------------------------------------
Octet001 ANSI SS7 Count=000001 Time=
--------------------------------------------------------------------------------
11011101 BIB/BSN (221) 1/93
11101111 FIB/FSN (239) 1/111
..101000 SU type/length (40) MSU40
00...... Spare 0
--------------------------------------------------------------------------------
Octet004 Service information octet
--------------------------------------------------------------------------------
....0011 Service indicator (3) SCCP Signalling Connection Control Part
..00.... Message priority 0
10...... Network indicator (2) N National network
--------------------------------------------------------------------------------
Octet005 Routing label
--------------------------------------------------------------------------------
........ DPC: Net-Clstr-Mbr XXX-XXX-XXX SMSC
........ OPC: Net-Clstr-Mbr XXX-XXX-XXX MSC
01010011 SLS 83
--------------------------------------------------------------------------------
Octet012 Message type
--------------------------------------------------------------------------------
00001001 Message type (9) UDT Unitdata
--------------------------------------------------------------------------------
Octet013 SCCP Protocol Class parameter
--------------------------------------------------------------------------------
....0000 Protocol class (0) Class 0
0000.... Message handling (0) Discard message on error
00000011 Ptr -> Called number 3
00000101 Ptr -> Calling # 5
00001010 Pointer -> Data 10
--------------------------------------------------------------------------------
Octet017 SCCP Called Party Address parameter
--------------------------------------------------------------------------------
00000010 Parameter length 2
.......1 Subsystem # bit (1) SSN present
......0. Sgnl pt code bit (0) SPC not present
..0000.. Global title ind (0) No global title included
.1...... Routing bit (1) DPC and SSN based routing
1....... Natl Intnatl bit (1) National address
00001011 Subsystem number (11) IS41 IS41D2000
--------------------------------------------------------------------------------
Octet020 SCCP Calling Party Address parameter
--------------------------------------------------------------------------------
00000101 Parameter length 5
.......1 Subsystem # bit (1) SSN present
......1. Sgnl pt code bit (1) SPC present
..0000.. Global title ind (0) No global title included
.1...... Routing bit (1) DPC and SSN based routing
1....... Natl Intnatl bit (1) National address
00000101 Subsystem number (5) MAP Mobile Application Part
........ Point code XXX-XXX-XXX MSC
--------------------------------------------------------------------------------
Octet026 SCCP Data parameter
--------------------------------------------------------------------------------
00010001 Parameter length 17
11100100 Tag (228) RESP Response, constructor, private use
00001111 Length 15
--------------------------------------------------------------------------------
Octet029 TCAP Transaction ID
--------------------------------------------------------------------------------
...00111 Tag (7) TCAP Transaction ID
110..... Class and form (6) Private use, primitive
00000100 Length 4
........ Responding ID
--------------------------------------------------------------------------------
Octet035 TCAP Component Sequence
--------------------------------------------------------------------------------
...01000 Tag (8) TCAP Component Sequence
111..... Class and form (7) Private use, constructor
00000111 Length 7
--------------------------------------------------------------------------------
Octet037 Return Result component
--------------------------------------------------------------------------------
...01010 Tag (10) Return Result component
111..... Class and form (7) Private use, constructor
00000101 Length 5
--------------------------------------------------------------------------------
Octet039 TCAP Component ID
--------------------------------------------------------------------------------
...01111 Tag (15) TCAP Component ID
110..... Class and form (6) Private use, primitive
00000001 Length 1
00000000 Correlation ID 00
--------------------------------------------------------------------------------
Octet042 Parameter
--------------------------------------------------------------------------------
...10010 Tag (18) Parameter Set
111..... Class and form (7) Private use, constructor
00000000 Length 0
--------------------------------------------------------------------------------
Checksum CRC16................ 0001110100001111 hex=1D0F
--------------------------------------------------------------------------------


I am betting most do not or will not understand this nor know what it is. so allow me to explain, this is a dump from crickets switch back when the flashed iphones would not deliver sms outside of the cricket home network,it is important because it shows that the carrier see's everything about your device,no matter if its there device or not,everything comes thru in binary.this particular dump has been decoded so you all can see it, some of the cricket engineers account specific info was removed but you get the idea.

your device tells on you every time it connects no matter if its for a call,sms,data,or multimedia and it gives all info from your number to your esn whether it needs to authenticate via those values or not.so get over the finger pointing,utube is NOT why this happened.lol