Virgin Mobile USA working data/mms/3g settings discovery thread

[Wrecked Johnson]

nice, if your doing this as a noob would love to see what you get going later.

[k12k08]

Any updates on this subject?

[overthatscreen]

I've got an Optimus V. I plan on rooting it later tonight. Just tell me what and how and I'll try my best to help out. Would love to see the Evo on Virgin Mobile USA.

[highlandsguy]

Yeah, post all of the non-unique to phone nv items: 465 and 1194 (if they are not phone specific). Which has the AAA key, since it is specific, right?

[NP08]

Yeah, post all of the non-unique to phone nv items: 465 and 1194 (if they are not phone specific). Which has the AAA key, since it is specific, right?

The 1194 on my Optimus V has 62 contiguous pairs of hex data, the rest are zeroes. 465 doesn't have much:

00465 (0x01D1)   -   OK
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 01 03 00 00 00 01 
02 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[NP08]

Since I don't see another way to get the AAA PW, I've gone through the NV Items file I downloaded out of the Optimus V tonight. It was a 300 page long txt file! I looked for 4~30 character strings in the items near the beginnings of the items. I've narrowed it down to 3 pages, and will look for some likely candidates and try them out one at a time. As far as I can tell, the Samsung Intercept according to [Only registered and activated users can see links. ] here on VM uses vmug33k for the HA PW (see post #6). For the AAA, he used a data log (logcat) to recover the AAA PW. I found this didn't work on the Optimus V- or maybe I wasn't doing it correctly- the process is different from the Intercept to the Optimus. I'll update if I get any results.

EDIT
Using past examples, I found that the Intercept on VM used a 12 digit text AAA PW, which would be 24 in hex (2 hex for one text character). I put in vmug33k as a user profile 1 text field in M.IP using QPST in another phone that QXDM can read user profiles on, and it returned a hex of 76 6D 75 67 33 33 6B. It appears to be basic encryption (note the consistency for "3" below), where:
76= v
6D= m
75= u
67= g
33= 3
33= 3
6B= k

Looking at my thinned-down NV ITEM file, there is only one 24 hex entry, and it's item 215 located at 0X00D7. The format is similar to other phones I've seen, it's preceded by a 00 in item 215.

That's my best guess for now. I don't have signal to test it here, but will do so later & update. Apparently the system locks you out for too many incorrect PW attempts, but it's only for 20-30 minutes each time.

UPDATE
QPST wouldn't allow a 24 character entry in M.IP, so I tried a couple of 16 character ones all with the HA of vmug33k. Still no luck. I tried to read the NAM1 A-key in CDMA WS but it didn't find anything.