HTC Touch Pro MEID Repair and super CID

[whitey10tc]

From old mobile files archive.... I didnt write this up and when I can find who the OP was I'll add his name!

Okay, so after many weeks of buggering around, thinking I had bricked my phone (many times!), reading many different posts, learning many new things.. Not to mention refusing to break down and pay for the latest version of CDMA workshop..

..Here it is. - A step by step guide to unlock, supercid, change the E$N and MEID on the SPRINT CDMA HTC Touch Pro. I have even attached all the files you will need to do this.. Almost all of them are available scattered around the internet, but here they are in one chunk.
I said almost all, because the most important one is the included modified radio file which is the ONLY one that will work to make this happen on the TP.
No need to do all the RAM scanning etc as previously posted for the latest CDMA Workshop solution.

This change will survive a full ##786# reset.

MAKE SURE YOU WRITE DOWN OR BACK UP ALL YOUR DATA SETTINGS BEFORE YOU DO THIS JUST IN CASE. They may need to be re-programmed. I had to call sprint to get mine because I forgot this step

I am giving you all, in order, step by step how I did this.. If you skip a step, it WILL NOT WORK - I am going to write this as simply as possible - 1,2,3 etc. I am not going to explain why mostly, just what to do.

All this was done using a PC running Windows XP.

And before I get started, I just want to say thanks to every poster on this site for all the free help over the years across many different posts and many different phones.. Finally, I can post something for free in order to give back to you all!! Now, if someone wants to send me a Touch Pro without the wandering touch screen issues mine is having these days... lol.

..and we're off

1. Backup your stuff! Read this post all the way through - make sure you are competent / familiar with what is being done. Download and unzip the files attached. Some AV software might have a problem with cdma workshop 2.7 cracked. I personally have clicked 'ignore' on the warning from Antivir and done a full scan afterward and found nothing. I think it is the way the crack file is written that makes it look like a bad file. It is designed to generate a file that is a key.
Make sure you know the com port number that your phone connects to when you put it in diag mode (dial ##3424#) If dialing ##3424# does nothing then flash back to a stock sprint rom for now.

2. Make sure you know your MSL / SPC code. If you don't know it or how to get it, Install attached BAFMSL cab to your phone to get it. It need Compact .Net 3.5 to work, This cab is also attached. Write MSL down. You may need it to program your data settings when you are done.

3. Flash your phone with Raphael_CDMA_HSPL_025_MFG.exe

4. Let phone re-start. Unplug usb cable from phone. My phone looked funny when it was starting up. This is normal - don't be scared!

5. Disable USB connection in Active Sync by unchecking checkbox in Connection Settings of Active Sync.

6. Hold Pwr and Vol Down buttons and push reset button to boot the phone in bootloader mode.

7. Connect Phone's USB cable to PC again.

8. Run mtty.exe

9. Leave every setting alone apart from change the 'Port' to USB in drop down box. Hit OK.

In the window that opens up, type the following commands (All Commands are case Sensitive) Hit enter after typing. You may see nothing while typing, just type carefully.

10. rtask a
11. echo_on
12. readCID
13. writeCID 00000000
14. readCID (window should return CID as 00000000)
15. rtask c (will probably give and error - mine did!)

16. Soft reset phone and close mtty.

17. Re-enable USB connection in connection settings of ActiveSync. Make sure phone is 'connected' to ActiveSync, you might have to unplug and plug in usb to make this happen.

18. Flash phone with Raphael_CDMA_HSPL_037.exe

19. Let phone restart.

20. Copy supplied radio rom RAPHIMG.nbh to your storage card. (If you have never flashed a rom from your storage card, Google or search the forums for info if the next steps don't work) If someone wants to wrap this radio up into an exe to be flashed from activsync then great, but I did say that my instructions would be exactly how 'I' did this.

21. Hold Pwr and Vol Down buttons and push reset button to boot the phone in bootloader mode. It should now display the option to go ahead and load the image file. Press the PWR button to continue.

22. When it is complete, soft reset.

23. Put your phone into diag mode (##3424#)

24. Launch DFS.

25. Select your phone's com port.

26. Select 6950 from the devices menu. Before you all start, yes I know we are programming a 6850, but the secret here is that the MEID portion of the 6850 equipment file in DFS ties up to the MEID locations in the radio rom supplied (which was ported from the diamond)

27. Ignore any errors at the bottom of the screen about equipment file not found etc... Remember, just follow the instructions!! So, once the com port is connected, go the MEID section and 0 out the dec or hex fields (Fill one of the fields with 0's. Ignore the pESN that it creates. DO NOT put anything in the ESN field. Click Write and it will write it to the phone no matter what it says at the bottom.

28. Close DFS and soft reset.

29. When your phone re-starts, you can open the dialer, select menu, select device info and you should see your MEID is now 0's. If yes, rejoice and carry on to step 30. If no, swear at the phone and go back to step 22 making sure you got the correct com port number selected (check your device manager in XP when you put the phone in diag mode - it's under com and lpt ports I believe..

30. Go into diag mode ##3424# again.

31. Open up the attached CDMA Workshop 2.7 and select the com port to connect your phone.

32. Go to the security tab and click read by the esn. It should display your current esn.

33. Type the esn that you want in the phone and click write.

34. Close CDMA WS and soft reset.


Done!!! Have some drinks! Congratulate yourself! or maybe first you should program your epst info with your phone number etc. Don't do data yet, you need to flash back to a regular radio before doing that.. Don't do that yet either.. Read on..

35. Place your first call from your 'repaired' device. All should be fine. If not, check your account settings, mdn, msid, prl etc.

IMPORTANT: As long as the meid remains as all 000s, you can go straight into cdma workshop 2.7 and change the esn again. If you do a ##786# reset, your meid and esn will return to original manufacturer settings and you will have to go back to step 20. It will survive a regular hard reset, rom flash etc.

If you are happy with your phone in this state, flash a new radio and program your data settings.

If you are sure you are all done with the number changing etc or need/want the correct meid in there that will survive the thermonuclear ##786# reset, go back into dfs (Step 24) and write the proper MEID for your new pesn. ***HOWEVER***, this will lock the pesn in and from what I have read, will not allow it to be changed again.. Well, until someone finds a way around that too! Flash a new radio and program your data settings.


Make sure you flash a new radio to the device to get text and other stuff working. They will not work with the radio that we flashed earlier for our dastardly purposes.

I do suggest a hard reset when all is done.

That's all Folks.. Have Fun!!


PS, sorry this write-up is so long-winded, I just wanted to make sure the majority could follow it. If anyone feels like I have missed something... Post away!

[Mr._Pseudonym]

;^) Now that's a good tutorial! Thanks for adding it, and be sure to add proper credit as soon as you learn who first wrote it.

[meanngreen04]

Great tutorial. This is missing 2 key files. 1. The special radio imported that allows the change 2. The program that goes with it. I'll look around an try to add the link.

[whitey10tc]

[quote author=meanngreen04 link=topic=336.msg1093#msg1093 date=1265950778]
Great tutorial. This is missing 2 key files. 1. The special radio imported that allows the change 2. The program that goes with it. I'll look around an try to add the link.
[/quote]Ya I have yet to find them if you find them please add them in. or if I find them I will.