flashing 16 byte AAA key over to Sprint Optimus S - 3G problem

Hi all,

I have a donor Sprint Vero that I've pulled all the relevant information off of.

The target is a Sprint LG Optimus S.

I copied over the MEID and did an OTA profile update, but that sorta worked about half-way.

Calls work, and 1x data works, but not 3G.

Subsequent "profile update" requests fail with error code 67.


My guess is that the AAA/HA keys are wrong.

I wrote down the two AAA keys and HA key ('secret') from the Vero.

I seem to be having trouble getting the 16 byte AAA key to stick when I write them.

By doing the LGNPST profile load + DFS read trick (as shown in that youtube video), I can view the keys on the Optimus S, but the 16 byte AAA key isn't matching what I specify. I've tried writing them by QPST, DFS, and LGNPST...nothing seems to stick. Any ideas on how to proceed?



  • Getting closer. The phone has the correct AAA and HA keys now. Turns out you can only write those in when the MEID is all 0s.

    I am now able to do profile updates and PRL updates successfully. However, I am still limited to only 1x. I should have 3G in this area, and another phone does have 3G.

    Are there any other settings that have to be set? In DFS, under the data tab, only HDR AN Long field's UID section is populated with [MEID]@hcm.sprintpcs.com

    Does anyone know if that is the correct value or if any of the other fields should be set?

    Comment actions Permalink
  • I'm a bit out of ideas a this point. I'm not really sure what's wrong.

    The phone updates its profile just fine. The error 67 that I used to get is no longer showing up. PRL updates are great and I'm at the current PRL.

    The AAA and HA keys and profile settings from the Vero are copied over and match as best as I can tell.

    However, when I check the status of the "AN-AAA" under the phone's debug menu, I get a value of "pending" which suggests that I have the AAA key wrong.

    Robert help me suspend/unsuspend the phone in an attempt to reprovision the system, but that didn't seem to make any difference (the phone didn't even notice it was deactivated and profile updates were still working as expected).

    Any thoughts on what might be wrong?

    One thing I'm suspecting is that I may have activated the phone improperly. When I activated the phone, the AAA keys were set to the original target phone's values instead of the donor phone's credentials. I wasn't able to get the actual donor AAA keys until after the phone was activated. Is it possible that I have bumbled things up such that I cannot fix it anymore (I don't have the original target AAA keys any longer...). If so, would cancelling the line and reactivating it with a new number fix the issue? Any other ideas?

    Comment actions Permalink
  • Well, it turned out that I was chasing my tail without cause. I had the right HA/AAA settings on this phone for a couple weeks now, I just didn't know it. I even tortured poor Rob at Ting by asking him to suspend the phone and later assign a new number and all that. All of it was not necessary. Thanks for putting up with me all the same Rob!

    I just had the wrong PRL loaded. The PRL that comes with the Vero is useless for what I was trying to do. Do not use PRL 50587 for a 3G phone. I assume I must have gotten that PRL on my Optimus S when I hit the "update prl" button (foolishly thinking that was a good thing when it was working...hah).  When I pushed the right PRL (61087) onto the phone everything worked upon the next reboot. 3G is now zipping along nice and smoothly and my signal strength went up significantly. This is the same PRL that was loaded onto my HTC Detail. I've attached it here in case anyone else would like to use it. Curiously, in my debug settings, my AN-AAA status still reports pending under EVDO debugging. I don't understand why, but I don't really care.


    In case anyone is interested in notes like this, the CDMA LG Optimus S/V is an amazing little phone that was built with some of the most solid engineering specs around. Side by side next to my HTC Detail (Evo Shift 4G) the Optimus gets way better signal reception (-87dB vs -120dB) and the GPS is much faster to start up. That increase in signal quality though only translates into meager bandwidth differences (680kpbs vs 563kbps) and those numbers tend to vary quite a bit. It could just be that 3G bandwidth is already close to saturated at even weak signal level (given my limited understanding of the way CDMA and TDM are used in EVDO, I think that was part of the design considerations for the protocol), but the Optimus would definitely fare better under poor signal environments than its more expensive cousin. You'd think that for how expensive these more "powerful" phones are, they would go to the trouble of putting in decent radios, but it's not quite the case. Either that, or HTC just makes relative junk (limited n here, not sure).

    Anyhow, I'm very happy that things worked out and I'm considering this a huge success. Ting is amazing and the most open and flexible provider around to not just tolerate, but encourage and even help crazies like me. I look forward to the change they will make in the rapidly evolving cell phone market. I have a few more Ting lines to activate, now that we can pull the codes from the Brio as well, the doors are wide open. Now if I could only decide on a good target phone to use...

    Comment actions Permalink
  • thanks for the PRL - I've been stuck with no data on my flashed HTC Incredible...going to try this when I get home! I would flash it now, but I'm testing an ICS rom that I really like, and will have to go back to a nand backup of my HTC Sense rom to regain DIAG mode access.

    Comment actions Permalink

Please sign in to leave a comment.