Evo 3D - 100% Working on Ting

Status: 3G data, SMS, voice calls, and voicemail are working.

Tools Needed:

(1) CDMA Workshop ($100)

(2) DataPilot 7 ($20)

(3) Sanyo Vero from Ting, fully working ($100)

(4) Evo 3D from Sprint, bought outright, legally, off contract, rooted ($800 original MSRP)

(5) HTC USB Drivers for Android Development

FYI: Because of Ting's repeated encouragement of changing your MEID, I do not believe you are commiting a fraud under 18 USC Sect. 1029: "Fraud and related activity in connection with access devices". However, I am not an attorney and I am not offering any legal advice on this matter. It would be nice to have a professional opinion on this issue, so if there are any lawyers who would like to chime in, please do so. You should also consider your state laws regarding changing serial numbers. Some states have stricter laws. Some require the intent to steal phone service, which, of course, none of us are doing. Note, though, if you clone your phone and use or attempt to use both phones at the same time, you have probably just committed a felony (again, my opinion, not legal advice). This article is the result of researching the effort required to move a phone to Ting. It is for research purposes only.

Step 1: Call Ting and get your MSL for the Vero, which you have all ready setup and activated on your account. They're cool. They'll just give it to you.

Step 2: Plug the Vero into your USB port. The drivers from DataPilot will give you access to the serial port of the phone.

Step 3: In CDMA Workshop, connect to the Vero. Send the Vero the MSL to unlock it (Security Tab).

Step 4: On the Main Tab, read and save the CDMA NAM1 settings. On the Security Tab, read and note the MEID. On the CAVE tab, read the settings and leave them in there.

Step 5: Remove the Vero, remove its battery, and permanently disable it. You are about to take its serial number, and it may not be running at this time.

Step 6: Plug in your Evo 3D and call ##DEBUG#.

Step 7: Use CDMA Workshop to connect to your Evo. Optional: Clear your MSL by writing 000000.

Step 8: Load the file in which you saved the NAM1 profile from the Vero and write it to the device.

Step 9: On the Security Tab, use the HTC method for changing the MEID to match the Vero.

Step 10: Write the CAVE keys.

Step 11: To get Voicemail indicator working you need a stock HTC Phone.apk (the Sprint one is configured for visual voicemail, which ignores the (luckily, standard) MWI indicator message that Ting sends to the phone). Find some instructions to locate a working Phone.apk and replace yours. Requires root, remounting your system, etc. Careful here, you can put yourself in a world of hurt awfully fast if you don't know what you are doing.

That's all. I know it is not very specific, but the Evo 3D works 100% on Ting; 3G data, voice, SMS, voicemail. Mostly just wanted to report the success here. Hopefully Ting will get a list of known working devices going. Or maybe we can do it here for them.



  • Almost forgot, under the data profile, it should autoprovision, but if not make sure the username is [your mdn]@mvno102.sprintpcs.com (you get there with ##3282#, enter the MSL for the passcode)

    Comment actions Permalink
  • In my research I found that there were 3 criteria that all had to be fulfilled regarding the illegality of changing ESNs. One was the intent to defraud. Since ting charges you based on actual use I dont see how there is any intent. If you were doing it with some other carrier to get onto a cheaper plan then you would be defrauding.

    I think this is one thing ting should (have their lawyers) look into.

    Comment actions Permalink
  • So, did you purchase your copy of CDMA?  If I could be certain that the software reliably does what it claims to AND was apt to use as such I'd pony up for it.  I am considering doing that exact same thing on a Galaxy nexus but I'm gonna wait about 5 weeks or so.  To see how things pan out in the market with new phones hitting sprint.  For all I know, Ting is gonna offer the Sprint branded GN or new HTC Hero and this won't be an issue.

    I'd rather that than have to hack it this way.  But, I'll do what I need to do to make the phone I really want work on Ting.

    Comment actions Permalink
  • Mr. Doe - is 4g working for you?

    Comment actions Permalink
  • Oops. Few corrections. Those instructions were from memory before and they are not quite right.

    (*6) Dial ##DIAG# not ##DEBUG#
    (*4,*10) Forget about the CAVE keys, they don't matter. False memory. I did not have to copy them, and Vero doesn't give them anyhow.

    Sagi, Yes, I purchased CDMA WS. It is a great app and if you are upgrading to a top-of-the-line device, it will save you a bundle.

    Scott, I have no idea. There is no WiMax around me (in the midwest countryside). I doubt it would work, because I have no 4G credentials. And the WiMax network would probably block the phone by its MAC address anyhow, unless it was held over from when/if the phone was used on Sprint, but I'm not too familiar with what security credentials are used for that tech anyway... sorry. I'd be cautious about using a connection type for which the device I purchased (Vero) is not authorized, but maybe that's just paranoia from being in the telco industry for so long.

    Comment actions Permalink
  • Has anyone else been able to bring their non-ting phone into ting with these instructions?

    Comment actions Permalink
  • btw, thanks John for putting these instructions together. Do you know if the instructions would be pretty similar for other devices? such as the Motorola Photon?

    Comment actions Permalink
  • (for clarification, Im hoping to bring in a Motorola Photon 4G from Sprint)

    Comment actions Permalink
  • Scott, I used these as a guide for Evo 4G. One difference - I couldn't read the values on the CAVE tab, but in the end it worked without that. For what it's worth, I have a rooted phone with Gingerbread.

    Comment actions Permalink
  • Hello Boris and Mr. Doe,

    I have a rooted Sprint HTC Evo 4g running CyanogenMod 9 (Ice Cream Sandwich) on the Sprint network.

    I am reading and learning here on these forums about getting an Evo 4G on the Ting.com service.


    1) In other posts I've read like "Nexus S on Ting - Working" ( https://help.ting.com/entries/21256192-nexus-s-on-ting-almost-working), the reference Profile 0 AAA and HA passwords and 

    Profile 1 AAA and HA passwords.  Are these passwords not needed (or irrelevant) for the HTC Evo?

    2) From the Nexus S post ( https://help.ting.com/entries/21256192-nexus-s-on-ting-almost-working), it also mentions provisioning data as shown in the italics text below.  Did you need to update the "First" and "Second" profiles?

    Provision Data:

    I don't have the step-by-step, but I followed Samuel's instructions below:

    So if you get into the QPST Service Programming screen, go to M. IP tab and enter:


    NAI:  YOURMEID@hcm.sprintpcs.com

    Home address:

    Primary HA address:

    Secondary HA address:

    SPI: 4D2

    SPI: 4D2

    Rev Tunnel Preferred: Checked now with both passwords hit ok. 

    Enter your HA Shared password first, then enter your AAA Password (32 Digits) into the text box.


    NAI:  Your10DigitPhoneNumber@MVNO102.sprintpcs.com

    Home address:

    Primary HA address:

    Secondary HA address:

    SPI: 4D2

    SPI: 4D2

    Rev Tunnel Preferred: Checked now with both passwords hit ok

    Enter your HA Shared password first, then enter your AAA Password (12 Digits) into the text box.

    Thank you!

    I just want to make sure I understand as I prepare to take the plunge.

    Comment actions Permalink
  • Mr Mendez - 

    Question 2:

    From John's first comment, he updated the data profile (possibly setting the username) on the phone and it updated all that data automatically. If that works all the profile data (ha/AAA passwords) will be obtained from Sprint over the air. If that works, cool, otherwise yes you'll need to enter this data. The AAA password and HA password are handled within this step, so Question 1 is the same answer.

    Comment actions Permalink
  • J Mendez,

    I used CDMA Workshop, and it copied the profiles along with the passwords. I don't know if the data connection would work without them.

    Comment actions Permalink
  • Hey, if anyone is interested in selling a license to CDMA workshop 3.8 I am interested in buying.



    Comment actions Permalink
  • Please email me at bkofman at _yahoo _dot com regarding CDMA Workshop.

    Comment actions Permalink
  • I got this working too! Thanks all!

    I used the Sanyo Vero as the donor phone, and cloned it to a EVO 3D.  I used CDMA Workshop ($100) to do the actual cloning work, but also used the free DFS Tool to help me determine which port the phone is connected to.

    I originally tried to get it done with the free version of DFS and CDMA but couldnt get it to work, finally I went and bought CDMA workshop 3.8 and followed the instructions above (everything works on my EVO 3D, except 4G).  It is so much easier to clone a phone (and data connections) using CDMA workshop than using DFS.  The reason is that in CDMA Workshop you just export NAM1 and NAM2 settings to a file from the donor phone.. and import NAM1 and NAM2 onto the target phone, write the ESN and you are done.  You dont need to copy and values and type your passwords etc as you would have to do using DFS.

    The difficult part is getting all the drivers to work for each phone, once that is done, it's actually very easy/quick to clone a phone.

    I managed to pick up a couple of Sanyo Vero's (you can download the drivers here: unlockgods.com/3820.zip).. but now that those are no longer in stock.. is it easy to get the drivers for the Samsung M370 ( https://help.ting.com/entries/21503426-dear-hacker-friends-vero-s-are-out-of-stock-discontinued ) or the Kyocera Brio? Anyone has experience using a different donor phone?

    Comment actions Permalink
  • Scott Lee,

    I am in the process of using the Samsung M370 as a donor phone for my Evo 4G.

    Here the thread: https://help.ting.com/entries/21770617-anyone-take-the-plunge-on-an-m370-yet 

    Here is my set up:

    Donor Phone: Samsung M370

    ---- Connects successfully using DataPilot v5 drivers

    ---- Got MSL from Ting. Works!

    ---- Connects to Port #12

    Target Phone: Evo 4G (Rooted).

    ---- Connects successfully using the HTC Diag drivers

    ---- I got the MSL using android app. Works!

    ---- Connects to Port #9


    - CDMA Workshop v3.8.7


    - Can successfully connect CDMA WS to both phones using respective MSL.

    - I can export NAM1 and NAM2 settings to a file from the donor phone.

    - I have the ESN and MEID from the Donor phone


    When I look at CDMA WS window OR in the exported *.nam file, I cannot see the "HA password" nor the "AAA password".

    Does your export have the password text it?

    Here is a section from the export of the *.nam file export:
















    Please confirm whether or not yours has the respective passwords for each in the NAM file export.

    I really hope your answer is NO.

    That way I will just import the NAM files, set the ESN+MEID on my Evo 4G.

    Then I can turn on the phone and go to Settings > "Update Profile" hoping that sets my missing passwords on the Evo.

    Thanks to you and anyone else that can help!


    Comment actions Permalink
  • Joe,

    From a quick look at your posting, I would guess the following.

    Profile0_HA_SharedSecret= is the "HA Password"

    Profile0_AAA_SharedSecret= is the "AAA Password"

    _That's just a guess on my part, though.


    Comment actions Permalink
  • Bruce,

    That is my guess as well.

    My problem is that  there is no value after the "=" sign for either one:

    a) Profile0_HA_SharedSecret=

    b) Profile0_AAA_SharedSecret= 

    I am confused as I see that many have successfully got their AAA and HA password.

    Yet, others say that you don't need them because when you do a "Settings > Profile Update", those values will be replaced/fixed anyway.  

    I cannot see those two passwords in:

    -CDMA Workshop




    So, I am confused.  I am thinking about just setting the ESN+MEID from the Donor phone onto the Evo.

    Then boot up.  Then  do a "Settings > Profile Update" and hope I do get a 3G connection.

    Your thoughts?


    Comment actions Permalink
  • Hello,

    I am trying to use the M370 as a donor phone for an Evo 4G.

    I have calls working, but NO data.

    If you have time, please read and post any ideas at this thread.


    Thank you in advance for your help! 

    Comment actions Permalink

Please sign in to leave a comment.