Trouble getting HA and AAA keys (LG Optimus S)

Does any one have any idea how to get the HA and AAA keys off of the LG optimus S? i almost got my evo 4g working with ting execpt data and the LG is my donor phone. Ive tried reading the NV with QXDM and it gives an error, and when i try the logcat method i don't get anything related to it and when i tried with LGnpst  it didn't show any... So the question is how can i get my HA and AAA passwords? if i contact ting can they give them to me or is there some other thing i can try myself?

UPDATE:

Looks like booting into recovery (clockworth) lets me read the NV items i needed, so far so good :)

0

Comments

19 comments
  • Clockwork recovery let you read the nv items? how did you accomplish that?

    0
    Comment actions Permalink
  • not sure if it was clockworth or just a function of the phone (was in diag mode before rebooting into it) but when i was in clockworth i was able to access it from a PC like it was in diag mode

    0
    Comment actions Permalink
  • Not to resurect a dead thread but can you possibly detail how you moved from the Optimus S to the Evo 4G? This is exactly the same migration I'm looking to do shortly. Did you use CDMA Workshop or were you able to use free tools instead?

    0
    Comment actions Permalink
  • i used CDMA workshop to get the MSL code for the optimus and there was a free app in the play store for the Evo, i think it was the free version of CDMA workshop that let me read the MSL. The rest i was able to pull everything except the HA and AAA keys using QPST and for those i had to use QXDM (finally got it to work by NOT sending the MSL while booted into clockworth, not sure wich was the magic trigger... ) how familiar are you with the tools? with QPST should just be a matter of pulling all the settings out  and writing them back to the evo and QXDM  running requestnvitemread ds_mip_ss_user_prof 0 and requestnvitemread ds_mip_ss_user_prof 1 i THINK (don't recall if that was the exact command) gave the keys in HEX, then use QPST to write the profile data to the evo remembering to tell it that its a hex value not asci. Good luck, let me know if i can be of any more help.

    0
    Comment actions Permalink
  • I'm not terribly familiar with any of the software. I don't have the target device just yet but I have been poking around the Optimus with CDMA Workshop. The Evo I'm getting has already been rooted and I'm considering rooting the Optimus (or at least getting the unlock code from Ting). It can't hurt to play around with reading stuff in QPST. I get the idea that I can adapt some of the guides to move devices from Sprint to other MVNOs. 

    0
    Comment actions Permalink
  • I've had the EVO for a day now and I've run into a couple problems. I too can't seem to read the HA and AAA keys from the Optimus S. Running a requestnvitemread ds_mip_ss_user_prof 0 in QXDM I'm getting "requestnvitemread - Error response received from target" in respone. I've tried doing it in the stock recovery mode but I get the same response. I'm wordering if I can bypass needing them if I autoprovision data on the EVO?

    Also, what tool did you use to write the MEID/ESN? I can't seem to find an option in the QPST service programming client.

    0
    Comment actions Permalink
  • for your optimus are u sure you got all the drivers? If i recall correctly i don't remmber getting that error, it would either return all 0s or it would give the key... As for writing the ESN and MEID i used the nv browser( i think EFS explorer in QPST) (forgot the exact name, don't have a windows PC infront of me atm either...) and made a folder that is called 

    open sesame door

    then reboot, the nvm folder should now be unlocked. u want to change item

    then read this post http://forum.xda-developers.com/showpost.php?p=19533128&postcount=9 (if i recall its what i did too(and thus i believe it to be correct), again sorry i didn't write down me exact steps as i did it... o well hindsight 20/20) that should get u well on the road for voice/sms

    u might also want to try sending your spc (spc <yourmsl/spc#here>) before doing the requestnvitemread on the optimus

    Good luck and if i can be of any more help/clarify anything let me know

    0
    Comment actions Permalink
  • wow sorry for all those typos (note to self, do not post on the Internet while very tired...). As for the auto provisioning of data, You can try it but i never could get that to work (i tried as well since i was having such  a hard time getting the HA and AAA)

    0
    Comment actions Permalink
  • I'm fairly certain I have the right drivers for connecting to the Optimus in debug mode. It does show up as being on three com ports (GPS, Modem, and I think debug). I only got the Optimus modem drivers so perhaps I am missing something? QPST does report my phone's # incorrectly.

    I did send my SPC before the requestnvitemread operation and that seemed to go through fine.

    When I look at the EVO's NV items in the browser I don't see any of the items that are listed in that post. I see plenty of other items but nothing called 0, 1943, 5597, or 5598.

    0
    Comment actions Permalink
  • hmm odd, you were in the nvm folder  on the evo correct? 0 should be the ESN and 1943 should be the MEID... the other two you can disreguard (i only did the first 2 on my evo) as for the optimus im sure sure you tried without sending the MSL but if not give it a try (I did with > noluck> reboot into recovery while still in QXDM i think and then didn't send MSL > worked , idk if its relivent but thought i would through that out there)

    0
    Comment actions Permalink
  • Got the keys! Ended up using the method where you use LGPST and then DFS. I have no idea why this works but it did.

    0
    Comment actions Permalink
  • Sweet glad you got the keys(and welcome to the unofficial BYOD crowd)! Hmm interesting thought there, i tried LGPST and then DFS and that didn't work for me, now i wonder though if since i tried LGPST if maybe that had something to do with getting it to work in QXDM, have you tried again in QXDM out of curiosity?

    0
    Comment actions Permalink
  • Not quite there just yet. Still trying to write the donor MEID\ESN to the EVO. DFS is telling me that the items are read only. I was able to write the NAI settings so I don't think it's a driver issue. Although when I wrote those settings I got an error that the IMEI was read only. I'm not sure what is going on.

    0
    Comment actions Permalink
  • Brian, if you do get it working, and if you're able to remember the steps you took, it would be an enormous help if you provided a step by step guide. I'm thinking of doing the same thing but to this point have been intimidated by the apparent complexity of it.

    0
    Comment actions Permalink
  • So after doing a read of the NV items with DFS I can confirm that items 0 and 1943 are on the phone, I just can't see them in the nvn\num folder. I'm halfway tempted to make my own 0 and 1943 files and see what happens. I presume they are stored in hex, correct?

    0
    Comment actions Permalink
  • Hey Josh, do you have any idea what the baseband version was on your EVO when you changed the MEID and ESN? I'm beginning to suspect that the more recent versions are locked down a little tighter than earlier ones.

    0
    Comment actions Permalink
  • hmm interesting thought, my current baseband version on my evo is 2.15.00.0808

    and just to be sure we both are talking about the original evo 4g (wimax) correct?

    0
    Comment actions Permalink
  • EVO 4g (wimax). My baseband is 2.15.00.12.19. This particular phone was repaired under warranty (but off contract) before my brother upgraded to a 4g LTE and gave it to me. If anything I think downgrading the radio might give me known memory locations for ESN and MEID.

    0
    Comment actions Permalink
  • Got it all working. I had to downgrade the radio and then use a QXDM and a list of known memory locations to zero out my ESN and MEID before re-writing my MEID. It was more time consuming than anything.

    0
    Comment actions Permalink

Please sign in to leave a comment.