Nexus S on Ting - Working

[Update] - I now have a fully working (except 4G) Nexus S on Ting.

Working:

  • Voice Calls
  • SMS
  • MMS - turn on mms for the account on Ting's website
  • 1x data
  • 3G Data

Not Working:

  • 4G Data - I believe I may have erased my wimax info somehow when I fried my phone (see below). I get an error that "Authentication failed" whenever I turn on 4G. Before I fried my phone it was at least connecting and redirecting me to a website that said to contact Sprint. When Samsung repaired my phone I got it back and my WiMax MAC Address was all 00's. I set it to what it was on the box, but still couldn't get passed authentication failures.

Getting Details from your Donor Phone (Vero):

  1. Call Ting and ask for your MSL
  2. Download drivers (Samuel Posted below) or buy Data Pilot
  3. Use DFS/CDMA Workshop/QXDM to find the following:

Profile 0 AAA and HA passwords

Profile 1 AAA and HA passwords

DFS 

  1. Connect vero to computer and open the port in DFS
  2. In the SPC box on top enter your DONOR_PHONE_MSL and press the SPC button.
  3. Switch to the Programming Tab
  4. Switch to the Mobile IP sub-tab
  5. Click Read in the lower left corner
  6. There's a "Profiles" section in the middle with Radio buttons. The first one corresponds to profile 0 and the second one Profile 1.
  7. Click the profile you desire - on the Vero the AAA Shared Secret and HA Shared Secret will be populated here. NOTE: some phones won't let you read this value.

MDN (these can be obtained in the next step)

MSID (these can be obtained in the next step)

Get your MDN and MSID from your donor phone

  1. On your donor phone dial ##DONOR_PHONE_MSL#
  2. Tap View
  3. Record your MDN and MSID for later use

Upgrade to ICS:

I let the phone update itself before reprogramming it. I don't think this is necessary, but I turned wifi on and told the phone to check for updates - it handled the rest.

Reprogramming your  Nexus S:

Changing your MEID:

  1. Follow the steps above to get MSL
  2. On your phone dial *#*#8778#*#*
  3. Select Modem for USB connections
  4. Connect your phone to your computer
  5. Open DFS CDMA Tool
  6. Click the ports button in the upper left hand corner
  7. You should see "Samsung Mobile Modem Diagnostics Serial Port xxxx" - if you don't make sure you have the correct drivers installed and you see the modem in your device manager.
  8. Type "01F2030F5F678FF9" into the Pwd box that has a bunch of "FFFFFFF" in it and click Pwd
  9. You should see "DEVICE UNLOCKED" in the bottom area - now you can reprogram your MEID
  10. Switch to the Programming tab
  11. Click Read in the MEID section
  12. Change the HEX MEID to match what your donor phone has
  13. Click Write
  14. You should see "COMPLETED" in the output at the bottom - if not try step 8 and then click Write again.
  15. In the upper right hand corner click reset - When your phone reboots it should have the new MEID

NOTE - YOU NOW HAVE TWO PHONES WITH THE SAME SERIAL # - YOU PROBABLY WANT TO AVOID HAVING BOTH ON AT THE SAME TIME.

Program your Phone Number (Use DFS/QPST/CDMA workshop or manually do the following):

  1. On your Nexus S Dial: *#*#NEXUS_S_SPC_CODE#*#*
  2. Tap Edit
  3. Enter the MDN from your donor phone and click the enter soft key
  4. Enter the MSID from your donor phone (often the same as MDN) click enter on soft keyboard

Provision Data:

I don't have the step-by-step, but I followed Samuel's instructions below:

So if you get into the QPST Service Programming screen, go to M. IP tab and enter:

FOR THE FIRST PROFILE:

NAI:  YOURMEID@hcm.sprintpcs.com

Home address: 0.0.0.0

Primary HA address: 68.28.15.12

Secondary HA address: 68.28.31.12

SPI: 4D2

SPI: 4D2

Rev Tunnel Preferred: Checked now with both passwords hit ok. 

Enter your HA Shared password first, then enter your AAA Password (32 Digits) into the text box.

FOR THE SECOND PROFILE

NAI:  Your10DigitPhoneNumber@MVNO102.sprintpcs.com

Home address: 0.0.0.0

Primary HA address: 255.255.255.255

Secondary HA address: 68.28.89.76

SPI: 4D2

SPI: 4D2

Rev Tunnel Preferred: Checked now with both passwords hit ok

Enter your HA Shared password first, then enter your AAA Password (12 Digits) into the text box.

5

Comments

135 comments
  • You're going to want to use QPST to do the data provisioning. You need to change both profiles (there are two!). At least on the evo, doing the ##3282# thing will only let you change one of them.

     

    So if you get into the QPST Service Programming screen, go to M. IP tab and enter:

    FOR THE FIRST PROFILE:

    NAI: YOURMEID@hcm.sprintpcs.com

    Home address: 0.0.0.0

    Primary HA address: 68.28.15.12

    Secondary HA address: 68.28.31.12

    SPI: 4D2

    SPI: 4D2

    Rev Tunnel Preferred: Checked now with both passwords hit ok.

    Enter your HA Shared password first, then enter your AAA Password (32 Digits) into the text box.

    FOR THE SECOND PROFILE

    NAI: Your10DigitPhoneNumber@MVNO102.sprintpcs.com

    Home address: 0.0.0.0

    Primary HA address: 255.255.255.255

    Secondary HA address: 68.28.89.76

    SPI: 4D2

    SPI: 4D2

    Rev Tunnel Preferred: Checked now with both passwords hit ok

    Enter your HA Shared password first, then enter your AAA Password (12 Digits) into the text box.

     

    Hit Ok, then click Write to Phone. Your phone will reboot and data should work.

    0
    Comment actions Permalink
  • Also, if anyone is wondering, you can use the Sanyo Vero as a donor and have 3G data.

    0
    Comment actions Permalink
  • Wait - your AAA Password is 12 digits? Here's what I found in logcat for my passwords - I wonder if that's where I'm going wrong.

    I/Username_Edit(  232): aaa_pw:tebkhd

    I/Username_Edit(  232): ha_pw:secret

    0
    Comment actions Permalink
  • It is 12 hexadecimal characters or 6 text characters

    so secret or 736563726574

    0
    Comment actions Permalink
  • Thanks! and the passwords are different for the first and second profiles? I notice the first one says 32 digits... 

    What process did you use to look up the passwords on your donor phone?

    0
    Comment actions Permalink
  • The AAA is different for both.

    DFS tool works to read them

    0
    Comment actions Permalink
  • This makes sense to me now!! I was using the same password for both profiles - I bet the second profile is for 1x data so it worked file, while I was using the wrong password for the 3g profile. Thanks so much for your help Samuel!

    I hope that I will be able to read this info off my Transform when I get home - it seems to be locked down more than usual. I can't connect the transform to QPST at all and get errors when trying to read any of the passwords - that's why I had the hackish way up above to get the passwords that I did get. 

    0
    Comment actions Permalink
  • From google for the transform:

    ***(Note: If you are having trouble with QPST recognizing your phone, instead of using the "Tethered modem" method when plugging in your phone, dial ##8778# and switch both the "UART" and "USB" options to "MODEM". QPST should then see your phone. Revert the "MODEM" option in the previous menu to "PDA" when done.)

    0
    Comment actions Permalink
  • Yeah - There is  no USB option on the Transform (Transform Ultra actually - I got lazy and stopped saying ultra) - the modem driver is installed without using that option. I haven't tried setting the phone to tether mode, hopefully that will open it up more. I really can't wait to get home to try all this out.

    0
    Comment actions Permalink
  • Unfortunately it looks like I bricked my nexus s through being stupid. I tried to write the nv items from the Transform to this phone before all the above discussion. Now the phone will turn on but it completely doesn't know how to access any of it's radios. The MEID, ESN, MDN, SPC and everything are empty. It's so messed up that I can't connect it to qpst to restore my backup. I have reset it to factory default several times and fastbooted the original radio, but everything fails. Looks like I'm out the 250 I spent on the phone. :(

    0
    Comment actions Permalink
  • You might be able to save it. I actually made the same mistake and was able to get it working again. If you can get to the fastboot menu you should be able to save it. Google "soft brick nexus s" and you should (eventually) find the right instructions.

     

    0
    Comment actions Permalink
  • I found a lot of suggestions on fixing a soft brick when trying to root. Most of those issues seem to be with a corrupted recovery - I think I totally hosed the radio and flashing the radio doesn't help. I've tried flashing the stock img files and tried flashing cwm and CM7. I may just call the customer care number for the phone and see if they can repair it somehow. I'm sure it's recoverable, but it might be beyond my skills.

    0
    Comment actions Permalink
  • If you call us on Monday, it will be tough for us to help you Scott. We'd like to have some people on the team adept at this stuff so we can offer help, we're just not there yet. That being said I might have a couple people I can refer you to (non Ting staff) who could offer you some help.

    If nobody can help you out in the forums this weekend, open a support request and tell them you were talking to me. Include the URL of this post too (it would be helpful).

    Have a great weekend (but be careful out there!),

    -Ben 

    0
    Comment actions Permalink
  • Ben - thanks for your support in this whole thread. I would be very interested in talking with anyone that might help, when I said I'd be contacting customer care, I was referring to Samsung/Google. I realize this isn't a Ting issue directly and wasn't expecting Ting to be experienced with fixing these type of issues. 

    We'll see where this weekend takes us. Hopefully Samsung will be willing to repair the issues at my expense and I will have a working solution at a minimal charge.

    0
    Comment actions Permalink
  • To fix mine I had to flash both the radio and NV items, then reinstall the rom.

    0
    Comment actions Permalink
  • How did you flash the NV Items with fastboot? I have been googling, but not finding much. There was a guy on xda that created a method to fix this issue on the evo, using a different hboot, but that doesn't look to be possible with this phone (no hboot).

    "fastboot -b" will flash to a particular address, I don't want to just go guessing where the nv items start though.

    0
    Comment actions Permalink
  • "fastboot flash nv" followed by whatever the nv file is named

     

    ex: fastboot flash nv nv.img

    0
    Comment actions Permalink
  • Yeah - did you do this on the Nexus or an EVO?

    C:\nexuss4gunroot>fastboot flash nv nexus_s.img

    < waiting for device >

    sending 'nv' (44 KB)...

    OKAY [ 0.008s]

    writing 'nv'...

    FAILED (remote: Unknown Partition)

    finished. total time: 0.011s

    0
    Comment actions Permalink
  • I did it on the evo.

     

    Here's a link that may prove helpful: http://forum.xda-developers.com/showthread.php?t=1241230

    0
    Comment actions Permalink
  • Everyone, Thanks again for all your help. I called Samsung today and probably experienced the best customer service I've ever had. They gave me a shipping label and are going to try to repair the phone for free. The rep said that they have been very good at fixing issues such as this - "they get down to the hardware level". So I'm very cautiously optimistic that they will fix this issue. worst case - in 2 weeks I'll have the phone back and it won't even turn on. _IF_ they are able to fix this, Samsung may have won me back over.

    0
    Comment actions Permalink
  • So the more I try and read up on the situation. The more it seems like Sprint/Samsung has gotten smarter about how they lock the information on these phones. I have been unable to get the passwords out of the transform at all and see that there are plenty of people that have the same issues with the intercept on Virgin Mobile.

    IF YOU ARE PLANNING TO HACK A DEVICE AVOID THE TRANSFORM ULTRA AS A DONOR.

    For me... it's not a big deal, since this is going to be my wife's phone. From Samuel's comments I think the Sanyo Vero is a good choice (especially with the price of it).

    Samuel/anyone - can you speak to whether 4G works on your EVO after cloning the Vero's ESN? Ben from Ting has stated that it won't, but I thought I saw someone say that it might and they would try.

    0
    Comment actions Permalink
  • I haven't been in a 4G area yet so I can't comment. I also have a feeling (no offense) that Ben and Ting don't really know what will or wont work in these situations.

     

    I wonder if they are hiring....

    0
    Comment actions Permalink
  • LOL - let me know if you want a reference! 

    0
    Comment actions Permalink
  • Scott and Sam:

    Did you have any luck getting 3G on your nexus S?  My friend and I want to share a ting account.  I'm willing to wait a bit to see what phones come down the road but likely no later than June.  I was thinking of getting a used nexus s 4G (fairly cheap now) along with a sanyo vero from ting as a donor phone.  That will be my friends phone and I'll get one of the larger phones such as the SGSII or whatever Ting is offering at the time.

    From what I understand, using the Vero seems to work fine as a donor phone.  Least it did for some one else.  I don't suppose you'd be willing to share the software you used to flash your nexus s?

    Sam:  You flashed an HTC Evo 4G with the vero as a donor phone, correct?

    0
    Comment actions Permalink
  • Sagi - I have used QPST, DFS and CDMA Workshop and can confirm that all of them work well with the Nexus S. I'm sure you can find versions to download. Over at  https://help.ting.com/entries/21199603-has-anyone-hacked-another-cdma-phone-to-work-on-ting Samuel and Chris talk about what they used a little - so I can say that Samuel used QPST+QXDM and DFS Tool and Chris says that he was able to fully flash the EVO 4G with CDMA Workshop in 10 minutes. I plan to buy that tool, if I get my Nexus S back from Samsung in working order.

    0
    Comment actions Permalink
  • Does the phone (in my case a used nexus s 4g with clean esn) need to be active on sprint or just have a clean esn?  Did you do this with current free version of dfs?  The versions I have of QPST and qxdm are from 2008..  I'd imagine I would need more recent versions.

    0
    Comment actions Permalink
  • It doesn't matter if the phone you want to use is active or not, it can have a bad ESN. Using a phone that has a bad ESN means that phone is stolen property - either someone literally stole it or didn't pay their bill on their old provider. I don't feel right doing that. Essentially you're taking the ESN from your new (Ting phone) and putting it on the phone you want, so the old ESN doesn't matter. Using an active phone though means you'd be paying a bill in two places... kinda silly aside from testing things out.

    DFS - I believe I use 3.3.0.7 and not sure what version of QPST... I think because the chips are all qualcomm based it doesn't matter the driver interacts with the software and is able to handle it. Newer is probably better, but you may be able to get by with old stuff.

    0
    Comment actions Permalink
  • Hey guys, I've been reading all the posts about making the  Nexus S work with Ting. I have to tell you that I've never done this before, so sorry for the stupid questions in advance. BTW, my nexus is not rooted and is running ice cream sandwich. My first problem is with "adb shell" and "adb logcat" I can get any of that to work, therefor, I can't get the HA and AAA passwords. I read where it only works with rooted phones. Next problem is *#*#SPC_CODE#*#* doesn't do anything. It doesn't give an edit option, therefor, I can't enter the phone number. I managed to get the phone unlocked and the hex and meid numbers onto the nexus. I downloaded QPST ver. 355, and it seems like it will work once I get past these problems.

    Once again, thanks for any help you can offer and remember, I'm greener than green!

    0
    Comment actions Permalink
  • @David Knighton

    for *#*#SPC_CODE#*#* you are entering your SPC/MSL right? QPST can wright your MDN if u cant get that method to work (when i did my phone once i got my SPC/MSL i was able to do the rest from QPST and QXDM). You can use QXDM to get your ha and AAA keys. Select the command output window and enter requestnvitemread ds_mip_ss_user_prof 0

    that will give u the hex keys for profile 0  then run requestnvitemread ds_mip_ss_user_prof 1 and that will give u for profile 1. QPST can then be used to write them back (just remmber you got them as hex so choose that as the input method)

     

    hope this helps some

    0
    Comment actions Permalink
  • Josh, Thanks for the info. I was able to get the SPC/MSL to work. I have the profiles set up in QPST excluding the HA and AAA passwords. I don't seem to be able to run QXDM. I keep getting an error message when I attempt to set it up.I disabled anti-virus and firewalls.  I might have bitten off more than I can chew. I've read where doing this with the transform ultra as the donor is a real pain. So far I agree. Thanks again for your info!!!

    0
    Comment actions Permalink

Please sign in to leave a comment.