Samsung M370 (Donor Phone) - Getting the AAA Shared and HA Shared Passwords

*Credits:

*
- None of this would be possible without the shared knowledge of others in Ting threads who have paved the way with other donor phones!

- Joey Scotti for his support, patience and persistence!

**

Things to know before you start:**

  • Donor Phone:  Samsung SPH-M370
  • Software:  QXDM (used for reading the elusive HA and AAA Shared Passwords)
  • Software: Data Pilot v520 trial  software  http://www.tucows.com/preview/421541

 

**
===== Getting the info from the M370 (donor phone): =====**

Connect your PC to your M370:

1)     Install the Data Pilot software which will provide the drivers for the M370

2)     Connect your phone.  Your laptop should recognize the M370 and install the drivers

 

Profile-0 (3G data):  Getting HA + AAA Shared Passwords:

1)     Connect the M370 to QXDM

2)     Select Command Output from the View drop down list

3)     In the Command box, type spc <your-MSL-here>  (without the “<” and “>” signs).  Example:  spc 123456

4)     Press Enter

5)     In the Command box, type Password 01f2030f5f678ff9 

6)     Press Enter

7)     In the Command box, type Requestnvitemread ds_mip_ss_user_prof 0 for Profile-0 which is your 3G data connection

8)     Press Enter

9)     To find the “HA Shared Password” for Profile-0:  Skip past the green text (as seen in the attached image in the word doc) and look for the purple/blue text for your passwords.  Look for mn_ha_shared_secret [0] thru [5].  In the example in the attached image, the hex password 736563726474 translates to ‘secret’ when converted to ASCII.  If you are curious and want to convert Hex to ASCII, you can use this site:  http://www.dolcevie.com/js/converter.html

10)  To find the “AAA Shared Password” for Profile-0:  Skip past the green text (attached image in doc) and look for the purple/blue text for your passwords.  Look for mn_aaa_shared_secret [0] thru [15]. 

   

Profile-1 (1x data):  Getting HA + AAA Shared Passwords:

11)  Repeat steps 7 thru 10 above, except that you will look for the Profile-1 (1x data) passwords by using the “Requestnvitemread ds_mip_ss_user_prof 1” command.

===== Sprint Evo 4G as the Target Phone ===== 

I was able to clone the M370 to my Sprint Evo 4G and now have the following:

- Calling

- Texting

- 1x Data Connection (initially until I found the Profile-0 passwords for 3G data connection)

- 3G Data Connection 

I used CDMA Workshop to transfer the settings from the M370 to the Evo as follows:

1) Import the NAM1 profile from the M370

2) Import the NAM2 profile from the M370

3) Set the Profile-0 HA Shared Password

4) Set the Profile-0 AAA Shared Password

5) Set the Profile-1 HA Shared Password

6) Set the Profile-0 AAA Shared Password

7) Set the ESN

8) Set the MEID

Enjoy!

Note: While I did use CDMA Workshop, others have also been successful with QPST and QXDM software which are both free. 

I am now a new Ting customer enjoying the  service and $aving$!

If you need clarification on any of the above steps. . . or find mistakes, please let me know.

I will update/fix the post.

Thanks, Joe . . . 

===== How to add MMS -- [Contributed by Joey on 8/8/2012)  =====

**To add that to get MMS (picture messages), you have to change the MMSC URL on the target phone. Ting uses the URL:  http://mms.plspictures.com for their MMS service, which differs from the sprintpcs URL that is pre-programmed on Sprint Android phones. I was told by Ting support today that in order to activate your MMS account, you have to send an 
MMS on your donor phone first, before being able to use it on your target phone. Then, on the target* phone, you have to change the MMSC URL. I say to do this on yoru donor phone first for good measure, as that is an unmodified Ting phone so the instructions Ting gave me should definitely work on the donor phone. I am trying this today on my lunch break and will report back if it is successful.

*


Step 1*: send an MMS message on your donor phone to activate your MMS account. if the message is not set successfully, you need to make sure your Ting phnoe has the correct MMSC url to begin with as well. Ting support can tell you how to get into the settings to change this, but I'm told the Vero at least is ##3282# (##DATA#).

*


Step 2:**

  • HTC Androids: dial ##DATA#, go to edit mode, type in your MSL for the target phone (I set mine to 000000 when I unlock my Androids). then scroll to MMSC URL and enter ** http://mms.plspictures.com**. Might have to hit menu to save changes, I don't remember.
  • Samsung Androids: dial *#*#DATA#*#*, go to edit mode, type in your MSL, go to 'Others', and change the MMSC URL to ** http://mms.plspictures.com**. I believe changes are committed instantly.

Step 3:  you may have to reboot. try sending an MMS from your target phone to a friend to test. Hopefully others can report if these instructions are successful or not.

4

Comments

52 comments
  • @Joshua Graves

    Body Glove makes some great phone cases, but none are waterproof.

    I've owned 2 Body Glove cases for 2 different phones, loved them both.

    0
    Comment actions Permalink
  • I have a m370 and I am trying to get some photos off of it.  It seems impossible!  Can't picture message as the phone says it "exceeds size limit". Pics are only 700-ish kb.  Can connect to it with bluetooth. Can pair, but not "connect".  Can't connect with USB cable.  I even bought the program DataPilot which it's support page says works with this phone - but when I run the software it says it doesn't.  (I will be calling them tomorrow.) 

    I'm really aggravated - what is the point of having a camera on the phone if you can't access the picture?   I want some pics off my phone to print out for my preschooler to take to class tomorrow afternoon.  Can anyone help? Thanks.

    0
    Comment actions Permalink
  • 0
    Comment actions Permalink
  • When I try to send a picture message the phone says it "exceeds size limit" with no indication what the limit is.  The picture is only about 700kb.  I've sent a message to Ting, we'll see what they say about that limit.

    In the meantime, I photographed the picture off my phone using another camera!  Kinda looks a little rough, but I guess it will do.

    Sorry if my message was a little incoherent - it was quite late for me and I had gotten quite frustrated. ;-)  Thank you for the response, I appreciate it.

    0
    Comment actions Permalink
  • @Tonya - instead of trying to send it as a MMS text message, try sending it as an email. The phone has 3G so it should be pretty speedy.

    0
    Comment actions Permalink
  • Starting from the picture itself, I could see no way to email it.  There was a "Send" option, and when I hit that button I would get the error message.  I never even got to a place where I could choose how to send it.  Perhaps if I started from the Contacts page I could attache the picture?  That is not what the manual says to do, and now I don't have the phone.   It is my husbands phone and he took it to work.  Heck, I even had an online chat with a Samsung customer service rep last night and they basically concluded that it was my service provider limiting the size.

    0
    Comment actions Permalink
  • oh yeah, and I tried to send it via bluetooth to my other samsung phone.  The phones could see each other and pair, but they wouldn't connect.  I also tried bluetooth using two different macs and a pc.

    0
    Comment actions Permalink
  • Hm. I used Data Pilot trial to install the drivers for the phone so the computer could see it. I would imagine opening up the phone in Data Pilot itself  should work, but I only used it for the drivers. Hopefully your husband can figure it out at work! Maybe he should try the Data Pilot trial while he is at work, if he has a desk job.

    0
    Comment actions Permalink
  • Data Pilot did install drivers, but it did not help the computer see the phone.  When I used the DataPilot software, there is a wizard for selecting the model of phone.  It is supposed to autodetect, which it doesn't, and when I try to manually select it, the m370 isn't listed.  But their website says it is supported. 

    0
    Comment actions Permalink
  • "Hopefully your husband can figure it out at work!"  - That made me smile. There's a reason my husband has a feature phone. ;-)

    0
    Comment actions Permalink
  • Haha. I thought you meant he took it to work to try to figure it out. Guess not. :)

    0
    Comment actions Permalink
  • @Tonya looking at page 72 of the User Guide (http://shop.sprint.com/global/pdf/user_guides/samsung/m370/m370_by_samsung_ug.pdf), there is a screenshot showing a file attachment and "534/600k" which leads me to believe that your phone has a MMS file size limit of 600K.

    0
    Comment actions Permalink
  • With the Samsung 400 replaceing the Samsung 370 in the Ting device list, do the same steps work on the M400 as did on the M370?

    0
    Comment actions Permalink
  • Excellent question about the M400. At the moment, I don't know if anyone has tried it yet. Chances are pretty good, but we won't know until someone gives it a shot.

    0
    Comment actions Permalink
  • First, thank you so much for posting this! I likely wouldn't have switched to ting without this.

    Any tips on getting QXDM to connect properly to the m370? I see the diagnostic port show up in device manager, and noticed qxdm briefly connect to it when I was fiddling with the phone for a few minutes, but the connection didn't last long. (note: I'm doing this under virtualbox since I'm on a mac, but that shouldn't make a difference)

     

    I'm trying to do this with an m370 and a verizon GS3. 

    0
    Comment actions Permalink
  • nevermind, read the comments about diag mode. 

    in case any mac/virtualbox users have initial users getting the phone USB to work in windows, I had to do the following in terminal (mtn. lion):

    sudo kextunload -b com.apple.driver.AppleUSBCDC 

    sudo kextunload -b com.apple.driver.AppleUSBCDCACMData 

    sudo kextunload -b com.apple.driver.AppleUSBCDCACMControl

    then try re-connecting the usb port in virtualbox

    0
    Comment actions Permalink
  • @Vivek Gani,

    Wow!  Nice job!

    Thanks for sharing 

    0
    Comment actions Permalink
  • ugh, I'm still stumped at the connection phase. control panel sees the com port, and so does QXDM, but I usually see the port just saying "COM4: waiting". Is there a diagnostic mode code (e.g. dialing something like *#9999*0# ) for the m370 that I'm missing?

    0
    Comment actions Permalink
  • I am having an issue doing this as my Galaxy S3 has a bad esn.  I got talk, text, and 1x data working.  BUT I cannot for the life of me get 3g, or LTE working, and I do have those in my area.  PLEASE HELP!!

    0
    Comment actions Permalink
  • I went through the same struggle, using a VZW GS3. I've been living with 1x data but eventually plan to just return the phone to stock and get something else. You may want to try different radio versions to see if that might help program in the 3G settings (you have to use an older radio rev. such as VRLF2 just to get the donor hack to work on the GS3).

    For those burning to have the 'ultimate travelhacker' phone on Ting, that is have GSM when overseas and LTE when in the states, just get either a sprint galaxy note 2 (and do the gsm board hack), or get an htc one.

    0
    Comment actions Permalink
  • Got 3g "Working".  It connects to 3g, but when I try and use it, it comes up with a page that says Forbidden: You do not have permission to access / on this server. UGH!

    0
    Comment actions Permalink
  • Hey i know this is an old thread, Im trying to port my m370 to my lg optimus g but its not working. I put all info in i get calls but data is stuck on evo rev a disconnected for some reason. Can you help me please?

    0
    Comment actions Permalink

Please sign in to leave a comment.