This action might not be possible to undo. Are you sure you want to continue?
This guide is provided as general information only; I am not responsible for what you do with it. If you end up with a broken phone and /or suspended account that's your problem not mine. …………………………………………………………………………………………………………………………………………………....
HTC Diagnostic drivers CDMA Workshop 2.7+ QPST 2.7 Build 355 QXDM 3.9.19 Boost mobile incognito usb drivers Boost mobile Rant usb drivers Win Hex Windows XP OS (Must have for incognito drivers) EVO ROOT Universal Auto Root w/ rom and 2.15.00.11.19
Windows XP (Must have for the Incognito Drivers) Rooted EVO 4G (Root files in guide) CDMA Boost Mobile Phone with 3G- Samsung Incognito or Samsung Rant
CLICK HERE FOR AUTOROOT W/2.15.00.11.19 CLICK HERE FOR ALL FILES NEEDED Download only if downgrading to 2.15.00.09.01
Round 1: (Incognito & Rant) Start out by installing all programs and activating you donor phone before you proceed. Now plug you donor phone into your provided usb cable and check the Device Manager for your Phones Com Port Number. Open Cdma Workshop and select the Com port you phone is connected to. Click connect and then Read. You should see your phones information displayed on the left. “If you’re using a rant as a donor phone it will display your SPC so skip round 1 & 2”.Click on the memory tab, under memory/Eeprom put start Address: 0363:0000 leave the size at 65536 bytes, now click read. The Sanyo Incognito sometimes can be very difficult to read the memory, keep trying it will work. You can try to turn off the phone on and off a few times and see if that helps.
Round 2: (Incognito)
and click the NAM Tab.1194. . open the memory file you just saved.write the 6 digit code from the . Round 3: (Incognito & Rant) Go back to CDMA Workshop. click on SPC . Recognize text by "6" uncheck everything expect for " Numbers" press "OK".” On the Rant Read all nvitems and save the each file. try all of them. Once the phone is unlocked. go to NV Items read and save items: 465.Gather Text. one of them is the SPC for your phone. SPC . click on specialist. as we will need the later on.txt file inside the box. they must be saved one at a time so for example the First NV Item: 465/ Last NV Item: 465 click OK and save it as 465 then move on to the next item and do the same. Remember to save it somewhere handy.txt document with 1 or more 6 digit numbers.1192. click on the memory tab.Now install and open up Win Hex.” Round 4: (Incognito & Rant) Stay in CDMA Workshop. save the file anywhere you like.466. Click “Read” this will display all your phones information inside of “NAM 1” Save the filename as NAM 1 and do the same for NAM 2. You should end up with a . "Security" tab.send.”On the Rant just click Read and it will display your SPC and click send and will say phone is unlocked” If you have multiple codes from your incognito. write it or them down. You should get a message saying that the SPC code is correct and the phone is unlocked. There will be nothing in 1192 or 1194 that’s ok.
(Pictured below) .
Click on Profile 1 and copy down your “NAI” and everything circled in the provided pictures. Open Service Programming and enter your Donor phones SPC. we need your Donor phones NAI.Continued…… Close Cdma Workshop. (Pictured below) . Click Read and navigate to the “MIP” Tab.
Requestnvitemread ds_mip_ss_user_prof . Password 01f2030f5f678ff9 hit enter. In the command input windows type. This will find your Ha Shared and AAA Passwords for profile 0. *Note Rant users this method will work for retrieving the shared password and AAA password. Open up QXDM and enter “ Password” 01f2030f5f678ff9” then First retrieve Profile 0 password by typing “Requestnvitemread ds_mip_ss_user_prof” retrieve your password by .Continued… Close Service Programming and open up QXDM.
save and return back to Qxdm. This password will be 6 digits long. once again you HA Shared will be “736563726574” scroll down for your AAA Password. .scrolling down to your HA Shared which should be “736563726574” For your AAA Provisioning password open up Nvitem 466 and read your 32 digit password after the “10”. Follow the pictures below elow. Enter “Requestnvitemread ds_mip_ss_user_prof 1” for Profile 1.
.Save all information in a notepad and label each Profile and save the passwords for both. This is for Profile 1 .
Turn off or put it on airplane mode. whatever you do don't ever have the phone on at the same time. .You are now done with your donor phone.
Now heres your 2 options that you have in order to find your Hidden Meid and Esn locations. This method can be a little harder and you might have to scan for your meid & esn locations but there hidden and can be found.00.00. This will guide you through the root process (don’t disconnect your phone let it root your phone and install the correct rom your Evo needs to complete the meid/esn write. 2.bat. CHOOSE ONLY 1 OPTION BEFORE YOU PROCEED!!!!!!!!!! .01 radio available for download here when the download is complete.15.09.15.Round 5: (EVO 4G) Now if you made it this far then keep going your almost there. 1. Downgrade your Rom to the 2.11.01 baseband and will have different meid & esn locations. Extract the File and Run the . Now start out by downloading the AUTOROOT W/2.15. make sure you have a SD card in your Evo and double click AutoRoot. Follow this guide down below and use the memory locations for 2.19 under baseband ver.15.exe file and follow the on screen instructions.11. Once this application is done you will be on the 2.00. It should read 2.15.00. Navigate to menu/settings/applications/development and turn on usb debugging.11. Once the download is complete extract it to a folder on your desktop and open the Auto Root Folder. Follow the instructions for this baseband below and you should find most of your locations.09.19 file. make sure you have your Evo in usb debugging mode by going to menu/settings/development. Once this is complete you should be on the correct radio you can check this by going to menu/settings/about phone and software information tab.00.19. It’s almost 400 mb in size and will take some time to download depending on your internet connection.
Do the same with the files for the Samsung Rant. (Pictured below) . I suppose you already opened the "Device Manager" and know the COM port for your Evo. 1192. You should now see your SPC code magically appearing inside the SPC box. write it down. Navigate to the “NAM” TAB and Write the Nam 1 and Nam 2 Files we saved earlier. NV Items and write the 4 NV Items we saved from your donor phone earlier.465. Password (16 digits) delete all the FFFFFFFF's and type 01F2030F5F678FF9 then send. If done correctly it should display your donor’s phone number and other information. and 1194. select the COM port -connect.read and your should see your phone information on the left. Now go to the “security" tab. 466. Next go to the "Memory" tab. Next we need to find your SPC code for the Evo 4G.Round 6: You need to dial ##3424# (DIAG Mode) you should now have a COM port listed under you device manager settings. but this is alot easier! Open CDMA Workshop.
Press F4 to get to the memory view. Options. click OK. Change Rows from 8 to 16.Round 7: (EVO 4G) Close CDMA Workshop and open QXDM.CommunicationsTarget Port/ select your Evo 4g Port. You should now be connected to your phone. (if you have any trouble connecting to QXDM make sure you set your com port in QPST Configuration and use the same in Qxdm's communications. select Command Output. So you can actually see what's going on from the View drop down screen. Find you HEX MEID and ESN by calling ##786# it will look something like this... .
Original: Separated: Flipped: MEID A1000009C57FQZ C5 09 00 00 A1 MEID A1 00 00 09 C5 7F QZ MEID QZ 7F ESN 8373B5C5 73 83 ESN 83 73 B5 C5 ESN C5 B5 *Note* Your Meid and Esn will differ from the one used in this guide please find your own and use the same method you will need this to find you Meid and Esn in the memory.MEID: A1000009C57FQZ ESN: 8373B5C5 They might have an "0x" in front of them. Make sure you have USB Debugging enabled in your EVO 4G now go to Menu>Settings>Applications>Development> Round 8: (EVO 4G) Start typing in the addresses in the example picture below and and Hit <Enter> . just ignore that. following the example MEID and ESN I provided above you are going to separate every 2 characters and then you are going to flip a few to make it backwards just follow my model and do the same to your numbers. Now pay close attention.
11.01) *Note if you chose option 1 then goto the txt file I have included in this guide and start typing in these commands for your 2.19 baseband *NOTE EITHER OPTION WILL WORK IF YOU DOWNGRADE IT WILL BE EASIER!!!!!!! .09.01 baseband OPTION 2.15.MEID & ESN Locations (2.OPTION 1 .15.15.00.00.00.00.MEID & ESN Locations (2.15.09.19) *Note if you chose option 2 then use the txt file I have included in this guide and start typing in these commands for your 2.11.
*Note I have also included a txt file for option 1 & option 2 with these locations for copy & paste At each location. If you only have 10 or less you will have to scan your memory in cdma workshop to find the remaining locations. (Use example pics for help) . Do not alter anything but meids or ESNS. You should end up with 9 Meid locations and 11 Esn locations. find your Meid or ESN and replace it with Zeros (0) then click Write and goto the next Meid or ESN.
*Note if you can’t find all locations use the information below to find your missing meid or esn. connect and send spc. Examples can be found below. (Pictured below) . Scanning for you “ESN” is simple. Under the ESN tab click read and click the drop down bar and select “Universal Ram Method” then click Write and Scan for addresses. They hide it can be tricky finding it but it’s not bad. Input “00FA-00FF on the 1st scan on the second scan search 0108-01D7. Open up cdma Workshop.
leave work with eeprom unchecked then click on the read button below it. start address put 00FA:0000 size 99999999. Save the file like scan1. ****Note**** If you can't find all the Meids use this method otherwise skip ahead to step 9 Open Cdma Workshop. This can be a frustrating step and not an easy one by any means but if you keep looking you will find it. *Note if you reboot and your Meid and or ESN is still not zeros then you missed a file somewhere in memory and have to go back to step 6 and rewrite every file again and look for the missing Meid or Esn.Round 9 (EVO 4G) After zeroing all MEID and ESN locations. Memory/Eeprom. Reboot your Evo and Dial ##786 to make sure the MEID and ESN is all zeros.bin. (This will read all memory between 00fa and 00ff. Then open up Win Hex to find all your Meid and ESN locations (in reverse of course) in your hex editor each address will have a offset where it found it you need to use a hex calculator and add your starting address to that number to get location of you Meid or ESN .It will stop when it hits the unreadable area but that's ok. Memory tab.
In QXDM type the following commands.example""" say you found an Meid at offset 2B710 in your hex editor on your 1st scan which started at 00FA you add 00FA0000 + 2B710 which gives you FCB710 which is actually 00FC:B710 you just add the 00's in front. (You can load up windows calculator and add the offset and location together to give you the area to search for in Memory in Qxdm. (Replace the X’S with your meid . do that for all ESN and MEID locations you find in each bin file Round 10 (EVO 4G) Now you can write your MEID/ESN of you Incognito to your Evo 4G.
.Password 01F2030F5F678FF9 RequestNVItemRead Meid (this will display the current Meid) RequestNVItemWrite Meid 0x00A0000000000 <-Meid/HEX ID from your donor Incognito/rant RequestNVItemRead Meid (This should now display your new Meid) RequestNVItemRead ESN (This should now display your correct Esn) You are now done close QXDM.
Knockout Round: (EVO 4G) Now open QPST Service Programming. . Once connected. Read from Phone and enter you Evo SPC code we got earlier. Continued. select your Evo and press OK.IP tab.. Navigate to the M..
Click profile 0 and click edit. then enter your AAA Password into the text box. Enter your HA Shared password first.12 SPI: 4D2 SPI: 4D2 Rev Tunnel Preferred: Checked now with both passwords hit ok.15.sprintpcs.0.12 Secondary HA address: 68.0 Primary HA address: 68. next Enter all information that you saved earlier and put them in the required box’s NAI: YOURMEID@hcm.28. .31. Check and make sure your “NAI” is the correct one for boost mobile.com Home address: 0.0.28.
next Enter all information that you saved earlier and put them in the required box’s NAI: YourName@myboostmobile.89.0 Primary HA address: 255.0.28.sprintpcs.0.com Home address: 0.Now Profile 1 information below……… Enter your HA Shared password first.76 SPI: 4D2 SPI: 4D2 Rev Tunnel Preferred: Checked now with both passwords hit ok .255.255.255 Secondary HA address: 68. then enter your AAA Password into the text box.
I want to thank everyone for the information I received and the various guides.com for all your EVO needs . Without you none of this wouldn’t have been possible. When it comes back enjoy 3g. Congrats you have now converted your Evo 4g to boost mobile. Visit AndroidHaKz.myboostmobile. Now for mms dial ##3282#. Change the URL to http://mm.sprintpcs.Make the active user “0” and Write to phone the Evo will now reboot. Tap on advanced and scroll down to you see the URL mms.com.com. and enter the SPC code.
This action might not be possible to undo. Are you sure you want to continue?
We've moved you to where you read on your other device.
Get the full title to continue reading from where you left off, or restart the preview.