未经整理的外文经验

zhengz

------------2005.10.31

A little the theory of the keys of siemens (or < that yet entirely they did not realize and they stole paid writers >):
In the "true" telephones of Siemens, built on ARM type of processor, all keys kriptuyutsya with the base values only of
two keys ESN and IMEI recorded in OTP (single-time programmed region of microcircuit Flash).
Remaining keys are in no way attached to the equipment and it is possible "to recount them" and to rewrite.

ESN (Electronic Serial Number)
- usually the 32- bit number, comprised of the series number of microcircuit Flash. The series number of microcircuit
Flash prescribes producer. He is situated in OTP the regions of microcircuit and contains from by the eighth of bytes.
Each microcircuit Flash has unique series number. The change (rerecording) of it is impossible. Frequently ESN confuse
with FlashID old siemens and represent in the form of sequence from ya-rekh of bytes, as they were stored in the old
telephones and were called on simenovski to 2002. as FSN (Flash Serial Number). PhoneID - this inverted is byte-by-byte ESN.

IMEI (International Mobile Equipment Identifier)
- is prescribed in OTP region Flash at Siemens's plant. After record IMEI block OTP "is shut from the record" - after
prescribing special bit in Flash to microcircuit. Record and the change of data in region OTP is impossible after this.
Flash Number IMEI in region OTP of microcircuit Flash is absent during the replacement by the new ( clean ), but it is
opened for the record. For the correct prescribing of number IMEI in OTP the region of the new Flash use  function Freeze,
having preliminarily prepared all "secret" blocks EEPROM and after writing down special "clean" or "new" BCORE with remaining
data of piercing. Attention: The access to OTP will closed and replace IMEI in OTP will be impossible after Freeze!
More attentively check that introduced IMEI into the the new Flash! The second time for new Flash microcircuit not will be!
In the telephone there are additional functions (on protocol BFC) of the step by step record OTP of region.
For their work is necessary the introduction into the telephone of key Skey. But to use them does not have special sense,
since region OTP on the user telephone is already closed from the record. During the replacement by the the new Flash to make
this without the additional checkings riskovanno even better to use a function"Freeze"  - it makes additional testings before
record IMEI in OTP zone.
IMEI participate in kriptovanii and be present in 52, 76, 5008, 5009, 5077, 5121, 5123 blocks EEPROM, and it is so prescribed
into region BCORE.

SKEY (service key)
- key from by the eighth of decimal digits for the repair and check-out works with the telephone. It opens the different
levels of access to the data of telephone on the different protocols of work with the telephone. There is until today had three
or four versions of modifiers this key depending on the type of telephone. Modifiers are introduced for limiting the access to
certain "secret" data in the telephone.

Basic modifiers of access on the priority:
"D" - for the strange developers (partial access),
"S" - for the service is center (partial access),
"X" - for the plant (complete access).
In the old telephones the introduction of key without the modifier is received by telephone as key for the service it is center
with the partial access.
Program x65PapuaUtils uses only maximum modifier with the complete access. For changing the level of access to the maximum, for
ASTS level 2.5e, there is knopochka "reading EEP Skey", which at the level of accessTO "S" reads SKEY and on the confirmation is
introduced  it withTHE "X" modifier.

Value for checking this key zakriptovano and to be stored in 5121 block EEPROM.
After correct introduction the key is stored in 5122 blocks EEPROM.

BKEY (Boot Key)
- this is key for the load of arbitrary butloadera into the telephone.
This key consists of 16 byte of khesh obtained on algorithm MD5 of the line with the expansion to 16 bytes into which they enter
ESN and SKEY.
With the message of this key into butloadere, telephone is produced above it function MDof 5 calculations of khesh and it further
compares this khesh with HASH of that recorded in region BCORE.
For series SGOLD, with the introduction of the correct SKEY into "Service mode" key BKEY is prescribed into block 52 eeprom and
telephone no longer compares keys for the load of arbitrary butloadera. For EGOLD this key to be stored in region EELITE...
BCORE Record HASH is empty with the "clean" or " the new " and BKEY so is not checked.

HASH (MD of 5 Khesh from Bkey)
- control signature for checking the keys BKEY, ESN+SKEY, and other blocks and the keys, which depend on ESN and SKEY.
This key consists of 16 byte of khesh obtained on algorithm MD5 of the line BKEY and is prescribed in region BCORE with the address
0xA0000238 in the telephones on SGOLD to platform (on NewSGOLD with another address) and usually into 0x800330 on EGOLD to the
platform of telephones. In the "clean" or "the new" BCORE this record is empty. It is calculated according to the data from EEPROM
and is prescribed by telephone according to the function"Freeze".

MKEY (Master keys) - to '-t' different keys from by the eighth of decimal digits for turning off of different blockings:
* # 0000 *the xxxxxxxx# - Blocking The network
* # 0001 *the xxxxxxxx# - blocking the supplier of the services
* # 0002 *the xxxxxxxx# - the personalization of the supplier of the services
* # 0003 *the xxxxxxxx# - the telephone code
* # 0004 *the xxxxxxxx# - blocking the subscriber's set of the network
* # 0005 *the xxxxxxxx# - only this sym
Where"xxxxxxxx" - the corresponding master is key.
Tyuey are zakriptovany and are stored in 5121 block EEPROM.

HWID (HardWare IDentifycial number)
- the decimal number of the model of telephone. In cryptography it does not participate.
...

Freeze
- this is the fixation of all keys in BCORE telephone and OTP from the deliberate BY EYEPROM blocks, with other additional markings.
If BCORE clean - to telephone are necessary no passwords, but do not work standard service svupy, but telephone ploughs to 100%.
For the work of the function of cutter is necessary correct calculation and record of blocks 52, 76, 5008, 5009, 5077, 5121, 5122, 5123
and "clean for crust". Given for calculating the blocks are taken from the page the "codes", and the number of "recoil" from the page "flesh".
This is plant method, but not patch. After introduction HAVE in this function, telephone all makes itself and prescribes all codes and
markings in BKORE and if Flesh is new and is clean, then HAVE in OTP a region also. This method works with Aof 50 models of telephones,
but on the models lower than S'shch a little another interface, since there another processor, but it is more studied by all and 4 I do
not see sense this to make in my program- test.

- by papuas
------------2005.4.3
PhoneId - it is Id of your phone, 4 bytes, for example 0xF748E421. You can see it in V_Klay.
PhoneCode - it is security code for some functions of the phone, 4-8 digits, for example 1234.
But *#0003* needs MASTER-code, not PhoneId, not PhoneCode.
Smelter doesn't calculate master-code, only PhoneCode and PhoneId.
- by avkiev
------------2005.3.28
;补丁中几个标志的含义
;Legend

;(c) - Copyright
;(p) - Ported
;(i) - Improved
;(r) - Respect
;(m) - Moved
;(t) - Textured
------------2005.3.28
What sorts of locks are there?

1. Lock phone to SIM card. If your phone is locked to the SIM you cannot use any other SIM than the one you have: SIM broken makes phone useless. A SIM Card Lock is a lock programmed into a mobile phone which only allows one company's SIM to be used in the phone. The reasoning behind this is to keep your custom to that network. Simlocks are also referred to as SP Locks or Network locks. Once your simlock is removed you can place any (dependent on phone model) SIM card into it including foreign networks if you take the phone abroad.

2. Lock phone to Operator (Network or Service Provider). If your phone is locked to an operator, you can use any SIM from this operator in your phone. You can switch between contract and prepaid as you wish, but not to a different operator.

3. Lock phone to CODE (Product Lock or Offer Lock). If your phone is locked to a code, the phone checks a special "password" (GID) on the SIM that must match your phone. Providers often use different passwords for contract and prepaid.

So unlocking is: Removing the locks on the phone so you can use the phone with any compatible SIM Card. Unlocking will allow you to use other service providers' SIM card. For example if you have an ABC GSM phone you can only put in an ABC SIM card, but if you unlock you can put in DEF XYZ, etc.

How can I verify whether my phone is SIM Card Locked?

If you place any card other than the one that the phone accepts, then you will get a message such as 'Incorrect Card', 'SIM Card not accepted', 'Enter Special Code', 'Enter NCK' or similar.

So unlocking is tampering with the software? - It can be, most programs to unlock on the internet change some data in the phone software other just make a log and calculate unlock code. You will have to type the unlock code with special code in your phone to unlock it.

Why should I unlock/upgrade my cellphone?

First of all we will give the reasons to unlock your cellphone: There are several providers in every country. A provider is a company from which you are using its network to communicate. Of course these providers are not all the same the one is better then the other. And ALSO the one is more expensive then the other. So if you buy cheap phone (that mostly comes with cheap provider because providers give money to make phones cheaper for us, and if the provider isn't that good, think about no network in distant places or in buildings, the provider has to find other way to get customers so they do it with making there mobiles cheaper) and then buy lose SIM card from better provider and you put in that SIM the phone says: 'SIM Card not accepted'.... (we are talking about prepaid phones here!!) Now there is the unlocking part :) When it is unlocked (or not locked, if you have contract your phone will likely not to be locked) you can put ANY SIM Card in it that you want.

------------2005.3.28
Produktionsdatum, Variant und Mapping-Info.

Beispiel anhand eines C6V P.-Date: 2004-10-11, Variant: B102, Std-Map/SW: 1/15, D-Map/Prov.: 4/143
Die x55 bis x62 Serie ist analog dazu zu sehen.
Hierfur muss Block 5005 mit dem EEPROM Tool ausgelesen und als txt Datei gespeichert werden. ?ffnet man die entstandene textdatei findet man ?hnliches wie hier (nur halt furs eigene Gerat):

00 FF FF 37 00 FF FF FF FF FF FF 0B A4 FF 0F 01
8F 04 02 10 2F FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF 47 FF 00 59 76
90 06 00 00 00 00 00 00 12 E6 01 02 E8 18 02 FF

Produktionsdatum: 0B A4 >
0B (hex) = 11 = Tag;
A (hex) = 10 = Monat;
4 (hex und letzte Ziffer dieses Bytes) = 4 für 2004 = Jahr
P.-Date = 2004-10-11

Std-Map/SW: 0F 01 >
0F (hex) = 15 = SW;
01 (hex) = 1 = Std-Map
Std-Map/SW: 1/15

D-Map/Prov: 8F 04 >
8F (hex) = 143 = Prov;
04 (hex) = 4 = D-Map
D-Map/Prov.: 4/143

Variant: 02 10 2 >
02 = Buchstabe des Alphabets 2 > B (A w?re folglich 01);
10 2 = Variant in Ziffern
Variant: B102

Viel Spass mit der Solution
by brandiber 2005
-------
Jetzt noch die Infos, die ihr in einem Mapping findet, das ihr einspielen wollt. Beispiel ist ein ein v43 Standard sowie Provider (Delta-) Mapping für CX70

Standard Map:

[MapFileInfo]
Product = 322 Hardwareversion wie sie auch das EEPROM Tool anzeigt. Wird vom Mapper mit der des Delta Mappings sowie der tats?chlichen Hardwareversion des Ger?ts verglichen
Provider = 0x00
MapVer = 0x01 Std-Map
SWVersion = 43 Ist natürlich die Softwareversion (SW) und sollte mit der im Delta Mapping übereinstimmen. Diese wird vom Mapper in Hex umgewandelt und dann im Ger?t abegespeichert (Siehe Block 5005)
Time = 170441
Date = 050125

Delta oder Provider Map:

[MapFileInfo]
Product = 322
Provider = 0x90 Kann so übernommen werden... also 90 (hex) = 144 = Prov. (Im Ger?testatus)
MapVer = 0x16B Davon holt sich der Mapper nur die letzten beiden Stellen und fügt sie in Block 5005 ein... also 6B (hex) = 107 = D-Map (Siehe Info Block 5005)
SWVersion = 43
Time = 145524
Date = 050128

Wer aus den Infos gern ein Mapping Tool schreibt: You are welcome  
Die Infos gelten auch für x45 Ger?te. ?ltere hab ich nicht gestestet.
Weiterhin k?nnte man noch folgendes einbaun:
Jedes Ger?t mit Hardwareversion kleiner 300 denke ich ist ein EGold Ger?t und braucht dementsprechenden Boot. Alles ab 300 SGold (so denke ich zumindest. Hat sich bisher so best?tigt und k?nnte in einen Mapper übernommen werden; also automatische Erekennung der Bootmethode anhand der Product-Info im Mapping )
Solution by brandiber 2005

高手翻译