xvrsfrnssks's blog

huawei unlocking algo

2010-03-25T18:31:00.000-07:00

// a tiny self made program to understand how the code generated for huawei card.
// compiled with lazarus.
// friday, march 26, 2010 - xvrsfrnssks

unit Unit1;

{$mode objfpc}{$H+}

interface

uses
Classes, SysUtils, FileUtil, LResources, Forms, Controls, Graphics, Dialogs,
StdCtrls, md5;

type

{ TForm1 }

TForm1 = class(TForm)
Button1: TButton;
Edit1: TEdit;
Edit2: TEdit;
Edit3: TEdit;
Label1: TLabel;
Label2: TLabel;
Label3: TLabel;
procedure Button1Click(Sender: TObject);
private
{ private declarations }
public
{ public declarations }
end;

var
Form1: TForm1;

implementation

function kn(a:string):string;
var
i:integer;
begin
result:='';
for i:=1 to length(a) div 2 do
result:=result+chr(strtoint('$'+a[i*2-1]+a[i*2]));
end;

{ TForm1 }

procedure TForm1.Button1Click(Sender: TObject);
var
s:string;
i:int64;
j:longword;
begin
// unlock const (hwe620datacard) = a32fe72c 5e8dd316726b0335 d5513ba0
// flash const (e630upgrade) = aa91cee2 97b7bc6be525ab44 cdc63be0
if (length(edit1.text)=15) and trystrtoint64(edit1.text,i) then begin
s:=kn(md5print(md5string(edit1.text+'5e8dd316726b0335')));
j:=(((ord(s[1]) xor ord(s[5]) xor ord(s[9]) xor ord(s[13])) and 1) or 2) shl 24+
(ord(s[2]) xor ord(s[6]) xor ord(s[10]) xor ord(s[14])) shl 16+
(ord(s[3]) xor ord(s[7]) xor ord(s[11]) xor ord(s[15])) shl 8+
(ord(s[4]) xor ord(s[8]) xor ord(s[12]) xor ord(s[16]));
edit2.text:=inttostr(j);
s:=kn(md5print(md5string(edit1.text+'97b7bc6be525ab44')));
j:=(((ord(s[1]) xor ord(s[5]) xor ord(s[9]) xor ord(s[13])) and 1) or 2) shl 24+
(ord(s[2]) xor ord(s[6]) xor ord(s[10]) xor ord(s[14])) shl 16+
(ord(s[3]) xor ord(s[7]) xor ord(s[11]) xor ord(s[15])) shl 8+
(ord(s[4]) xor ord(s[8]) xor ord(s[12]) xor ord(s[16]));
edit3.text:=inttostr(j);
end;
end;

initialization
{$I unit1.lrs}

end.

// http://hotfile.com/dl/54871974/2ae81b0/project1.exe.html (uploaded july 15, 2010)

Stand Up To Cancer

2008-09-05T18:11:00.000-07:00

standup2cancer.org

unlocking huawei e220..manually

2008-09-02T17:05:00.000-07:00

below is my attempt to unlock a huawei e220 datacard. so please understand, i do not take any responsibility for your actions with this information.

let's get it right, shall we...

preparation

1. E220Update_11.117.09.04.00.B268.exe
2. QC BQS Analyzer
3. Hex Editor
4. E220 SimLock_UnLock.exe
5. E220 DataCard in your USB port

the work

run the E220 Firmware Update Wizard until datacard is detected and cancel it. your e220 will be detected more easily by QC BQS Analyzer.

run QC BQS Analyzer, choose 'Communication' - 'Use Com/USB Port'. a 'QC Com Diag Window' will appear. test your connection.

1. set your Serial Com Port (3G PC UI Interface, not the other one)
2. click 'Send Cmd'

you'll get 'Successfully send command.' and output similiar to the textbox. If you got no response at all (no output or 'CommError'), you have to restart the process.

set 'Read EFS' from Standard Mode dropdown menu, click 'Lets go'. name the file (efs.bin), save it.

open saved file with hex editor, search for following hex-chain: 53-64-2C-00, and you should see the unlock code.

run E220 SimLock_UnLock.exe, enter your unlock code.

remarks

Hardware & Firmware Version : ^FHVER:11.117.09.04.00,CD33TCPUB"
(AT^FHVER)

Tested on : T-Mobile E220, INDOSAT E220