Network Unlock an Orange M3100 (Hermes)

[Shadamehr]

Can this be done yet..???

[pof]

Is it really locked?

At the moment no one has a locked device yet, even operators are selling them unlocked.
See more details here:
http://wiki.xda-developers.com/index.php?pagename=Hermes_Versions

[nightshot]

Ive got one and its locked!

[pof]

Ive got one and its locked!

ok, i update the wiki then!

[Shadamehr]

Orange always lock them.

So back to my question - anyone know how to UNlock them yet, or is it way too early?

[pof]

anyone know how to UNlock them yet, or is it way too early?

Not so many people have locked devices, so you'll have to research if you want to unlock it. What I recommend is reading how other HTC devices are unlocked, and most probably you'll only have to adapt to Hermes.

These are interesting things for you to read:
http://wiki.xda-developers.com/index.php?pagename=xdadev_all_unlock
http://wiki.xda-developers.com/index.php?pagename=Wallaby_HT_Unlock2
http://wiki.xda-developers.com/index.php?pagename=Prophet_Unlock_Sim
http://wiki.xda-developers.com/index.php?pagename=BA_Unlock_Sim
http://wiki.xda-developers.com/index.php?pagename=Uni_Simlock_by_Buzz_and_team
http://forum.xda-developers.com/viewtopic.php?t=33796
http://forum.xda-developers.com/viewtopic.php?p=271547

A good starting point would be to have a dumped rom from an unlocked Orange SPV M3100 and a dumped rom from a locked one, better if the two dumped ROMs contain the same versions. For more information look here:
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom

Good luck! :D

[pof]

Related page on wiki:

http://wiki.xda-developers.com/index.php?pagename=Hermes_SimUnlock

[Shadamehr]

No sorry mate - we are normal people after a normal layman's answer, much like the simple explanation as to how to unlock the Wizard when it came out.

I am grateful indeed for your help, but its FAR more technical and over my head than the reply I was after...

Cheers though.

[gpstoloff]

No sorry mate - we are normal people after a normal layman's answer, much like the simple explanation as to how to unlock the Wizard when it came out.

I am grateful indeed for your help, but its FAR more technical and over my head than the reply I was after...

Cheers though.

OK, here's a normal layman's answer: NOT YET, IT'S A BRAND NEW MODEL. BE PATIENT! :roll:

Before we can give you a simple, step-by-step process, someone has to do the hard work -- the experimentation that was described in the previous post. Many of the people on this board are the technical boffins who will develop the solution; he simply thought you might be willing to do it and offer some guidance to get us all further along the path.

Plus, only the Orange models appear to be locked; all other operators appear to be selling unlocked versions. It'll have to be an Orange owner, and they just started selling them this week.

[pof]

Yes, that's the point... it will be possible as long as people starts having locked devices, it's just a matter of time :)

[nuttyphilt]

Try www.imei-check.co.uk

My Orange M3100 is now running quite happily on T-Mobile :wink:

[Stubzz]

Ouc, £20. Think I'll leave it for a little bit later til I do mine.

[pof]

Try www.imei-check.co.uk

My Orange M3100 is now running quite happily on T-Mobile :wink:

Do they unlocked it for you? Do you know how they do it? Can you "reverse engeneer" the changes done on the phone? Can you provide more information? :P

[nuttyphilt]

Try www.imei-check.co.uk

My Orange M3100 is now running quite happily on T-Mobile :wink:

Do they unlocked it for you? Do you know how they do it? Can you "reverse engeneer" the changes done on the phone? Can you provide more information? :P

Yes, they unlocked it for me. I was a beta tester for them and got it unlocked successfully earlier this evening.

I have absolutely no idea how they do it, unfortunately I don't have the technical skills otherwise I would've done it myself :D

[pof]

I see the process here:

http://www.imei-check.co.uk/m3100unlock.php

Can you share the M3100v1unlock.exe file which will only work for your IMEI?
we can probably reverse engeneer what it does from there...

Thanks :D

[risidoro]

I see the process here:

http://www.imei-check.co.uk/m3100unlock.php

Can you share the M3100v1unlock.exe file which will only work for your IMEI?
we can probably reverse engeneer what it does from there...

Thanks :D

I think that a full reverse engineering can be avoided. The unlocker -which is freely downloadable- simply asks the user to insert a password code that matches his phone's IMEI before going on with the unlock. Bypassing this check should be fairly simple for a skilled programmer (cracker). Or he could develop a code generator.

The only problem is: Is it correct to do this?

[pof]

Bypassing this check should be fairly simple for a skilled programmer (cracker). Or he could develop a code generator.

The only problem is: Is it correct to do this?

No, it is not correct, but we don't want to do this... we just want to know what the unlocker does, and then write another app (not hack the existing) to do it, and release it for free :)

[azpirito]

Anything new about unlocking this unit??

Thanks a lot.

[iboj007]

Also, how could one go about flashing a TyTn ROM onto the 3100? Has anyone done this yet?

[bigneeker]

I hope someone finds a solution to this. I just bought one on ebay thinking that someone had already managed to sim-unlock it and be able to change roms on it.

[daddyo]

can anybody tell me if you have to hard reset the m3100 wheb you sim unlock it? i.e. do you have to reinstall all the software?

thanks

[mackaby007]

[/quote]
Plus, only the Orange models appear to be locked[/quote]

My VarioII is Network locked!

[danktuft]

Same here, Vario II locked upon purchase.

[pof]

If someone pays the SIM Unlock service from imei-check, please sniff the USB commands it sends to the bootloader (using HHD USB Monitor (http://www.hhdsoftware.com/usbmon.html)) and post them here, this way we can write an app that does the same for free. PM me if you need help on that.

[bigneeker]

i just read on another post that someone managed to put a tytn rom on an m3100.
is that possible without sim-unlocking it?

[nightshot]

it is possible to put another rom on the m3100 but it will still be network locked to orange

[nightshot]

If someone pays the SIM Unlock service from imei-check, please sniff the USB commands it sends to the bootloader (using HHD USB Monitor (http://www.hhdsoftware.com/usbmon.html)) and post them here, this way we can write an app that does the same for free. PM me if you need help on that.

tried this and got this:

pic attached

[pof]

shit! I guess this means it detects that there's something running on the USB port. Did you have USB disabled in ActiveSync when you tried? Can you try again using SourceQuest USB Analyzer (http://www.sourcequest.com)?

Thanks!

[mikechadwick]

[quote=nuttyphilt]Try www.imei-check.co.uk

My Orange M3100 is now running quite happily on T-Mobile :wink:

i tried this last night on my Vario 2 and it just hung. in communication with their support at the moment.

[Osir1s]

Just to confirm the unlocker from http://www.imei-check.co.uk does work on the orange m3100 doesnt it? Im assuming since there is no orange rom updates that the radio version will most certainly be 1.06 or less?

cheers.

[jah]

My unlocked M3100 is working fine; tested with O2.

[AndyM]

Same here. Unlocked my SPV M3100 using imei check and it works fine with my company o2 sim.

[AndyM]

Same here. Unlocked my SPV M3100 using imei check and it works fine with my company o2 sim.

[Osir1s]

excellent, cheers. one last thing though im getting one sent to me from the uk to Australia it can still be unlocked via that website, even if the device is in Australia cant it?

[DenisJ]

Hi there
is there any news about the SPV unlock pls ?
Thanks

[vincexda]

The IMEI check unlocker now works for Vario II's for those of us on T-mobile.

[jugulator]

Any progress of finding a free unlocker for SPV M3100? :lol:

[happytomato]

i dont have a hremes but i should be able to write a crack, could someone please pm it to me

[pof]

@happytomato:

You can download the unlocker here (http://www.imei-check.co.uk/M3100v2Unlock.zip).

but the "crack" is not so easy to write as the imei-check unlocker is quite protected: binary file packed with themida (http://www.oreans.com/themida.php), detects USB monitor software, detects when debugger is running on system, crypts strings on memory...

[BazzerB]

Has any progress been made in the mean time for creating a free unlocker to the Hermes.

I'm about to pay 20 pounds to imei-check, but I'd also be willing to spend that on a donation to our community (xda-devs) for whoever comes up with a free solution by wednesday of this week.

-B

[pof]

Has any progress been made in the mean time for creating a free unlocker to the Hermes.

Pay the 20 pounds to imei-check and send us an USB dump of what the program does to unlock the phone.

If you are unable to run the imei-check unlocker while captureing USB traffic try using a virtual machine soft like vmware, and run the unlocker from a virtual machine OS while sniffing the USB port from the real OS.

[fun_key]

I investigated some ways to dump the USB interface. Sadly I am not able to test at the moment; I setuped the latest rom available and the the imei crack isn't compatible with it (Communication error #1) and I cannot downgrade the rom for further testing.

Did you tried to play with user rights in order to achieve the dump? One solution would be to launch the crack with simple user right and the USB mon or the debuger with admin rights, the crack should normaly not be able to "see" the debugger/usbmon. I did some testing, but as I always get the communication error. I cannot tell if only phone related or if it may come from the crack security.

One interesting point; with my setup I was able to get this printed on my phone:

"SIM-UNLOCK

Initializing..." and the progress bar goes much further than when I just start the usbmon+crack with the same user

Feel free to try, I cannot help anymore with my phone; but I am pretty sure that my solution may work! Feel free to ask for more details

[pof]

One interesting point; with my setup I was able to get this printed on my phone:

"SIM-UNLOCK

Initializing..."
This can be downe with 'set' and 'shmsg' bootloader commands (http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader), not very useful if you cannot dump the full unlocking process on USB port :(

There is several other software for monitoring USB ports, if someone wants to try:

http://sourceforge.net/projects/usbsnoop/
http://www.wingmanteam.com/usbsnoopy/
http://www.aggsoft.com/usb-port-monitor.htm
http://www.hhdsoftware.com/usbmon.html
http://perisoft.net/bushound/
http://www.sourcequest.com/
http://www.sysnucleus.com/index.html

[fun_key]

One interesting point; with my setup I was able to get this printed on my phone:

"SIM-UNLOCK

Initializing..."
This can be downe with 'set' and 'shmsg' bootloader commands (http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader), not very useful if you cannot dump the full unlocking process on USB port :(

There is several other software for monitoring USB ports, if someone wants to try:

http://sourceforge.net/projects/usbsnoop/
http://www.wingmanteam.com/usbsnoopy/
http://www.aggsoft.com/usb-port-monitor.htm
http://www.hhdsoftware.com/usbmon.html
http://perisoft.net/bushound/
http://www.sourcequest.com/
http://www.sysnucleus.com/index.html

I know; but this show that the unlock processing is starting. I am pretty sure that with my solution it is possible to dump the entire unlocking process.... But, as I said, I cannot achieve it because of the radio version of my phone

[pof]

Sadly I am not able to test at the moment; I setuped the latest rom available and the the imei crack isn't compatible with it (Communication error #1) and I cannot downgrade the rom for further testing.
I know; but this show that the unlock processing is starting. I am pretty sure that with my solution it is possible to dump the entire unlocking process.... But, as I said, I cannot achieve it because of the radio version of my phone

Why can't u downgrade? Tell me which device, which rom, which CID and bootloader version you have and probably I can help you.

[fun_key]

I got an orange CID with the 1.31 cingular ROM. As there are no orange rom available I just cannot return to 1.04 bootloader and flash whatever i want :roll:

[pof]

I got an orange CID with the 1.31 cingular ROM. As there are no orange rom available I just cannot return to 1.04 bootloader and flash whatever i want :roll:

shit happens... hope that orange releases a rom soon.

I've been investigating on the issue (I got two Hermes, one original HTC TyTN and one preproduction version SuperCID and seclevel=0, both unlocked). If my guesses are correct the SIMLock data and the CID are stored on a encrypted block at #BDK1 as in previous HTC devices, the encryption method is known but the keylist is unknown on the Hermes, and I don't know where and how to get the rigtht keylist (anyone with experience in writting unlockers for other devices would probably help on that).

Theoretically if you would know how to send AT commands using the bootloader on the Hermes (anyone?) you can connect to the bootloader and put a "Locked" sim (which normally you can't use) on your device and try to register to network using AT commands. If registration is successful (ie, you can call the SIM number) that means that the simlock code is handled by the OS and only the radio would need to be patched (as on the Universal unlocker) to bypass the seclevel check, so an unlocker tool would be easy to write for an experienced xda-developer, but as I am quite ignorant on these issues correct me if I am wrong :)

buzz is looking at it, but AFAIK there's not too much progress yet :(

[vijay_kumar]

I got vario 2 & it's locked , can anybody tell me how 2 unlock it , i'm new to these stuff :( Any help would be really appreciated !

[frustin]

have you read any of this thread?

[jugulator]

Any progress here??

[pg_piotrek]

I have Dutch TyTn model Hermes200 from Orange, equipped with dual SIM device.
I have installed there - two SIMs from two different providers - Orange, and KPN.
I can switch between SIMs and make calls, no problem. I can also use each SIM separately - and also no problems. But I cannot change the network...
It can be only Orange...

I understand that SIM lock for now cannot be removed (for free) from TyTn, but what about Network Lock?

[braindead]

This can be downe with 'set' and 'shmsg' bootloader commands (http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader), not very useful if you cannot dump the full unlocking process on USB port :(

There is several other software for monitoring USB ports, if someone wants to try:

http://sourceforge.net/projects/usbsnoop/
http://www.wingmanteam.com/usbsnoopy/
http://www.aggsoft.com/usb-port-monitor.htm
http://www.hhdsoftware.com/usbmon.html
http://perisoft.net/bushound/
http://www.sourcequest.com/
http://www.sysnucleus.com/index.html


ehehehehehehe very nice information ;D u love what u do.... maybe someday i will see u in another place .... or maybe not.... anyway a big hug ur in the right way.......

[intgom]

Wiki updated after email exchange with Orange confirmed that they will unlock your M3100 for £20.

http://wiki.xda-developers.com/index.php?pagename=Hermes_SimUnlock

Not that I support paying for the service but some people may prefer using Orange instead of imei-check.co.uk

[vijay_kumar]

Hello ,
i've unlocked my vario 2 using imei check & i got the network signals but i can't make or recive phone calls ? How 2 hard reset vario 2 ? PLz help

[pof]

@vijay_kumar: PLEASE READ THE WIKI
http://wiki.xda-developers.com/index.php?pagename=Hermes_Resets

[vijay_kumar]

Thanks
Wht u think why i can't make or recive calls ?

[pof]

I don't know... if hard reset doesn't help try to upgrade the radio:
http://wiki.xda-developers.com/index.php?pagename=Hermes_ExtractedRadioRoms

[gurry]

can confirm the imei-check service works.

unlocked and used tmobile sim in it no problem. Ill post the necessary once Ive figured how to use usb loader.

would there be any milage in sending someone the unlocker exe and the imei specific file that was needed to unlock?

cheers

gurry

[Izzard-UK]

I'm intending to buy a TyTn from Orange tomorrow (or very soon) so I'll shortly be unlocking it to use my T-mobile SIM. I intend to use imei-check.co.uk to do this and I am willing to try sniffing the USB port.

However - I guess I'll only get one shot at this, so...

Can someone suggest which USB sniffer hasn't been tried yet?
If it's going to refuse to play on the basis that a sniffer is found using the USB port, will it complain before it unlocks the phone?

What I'm trying to establish is if I can try several sniffers in sequence without unlocking the phone 'prematurely' and blowing the opportunity to get a dump.

"Forewarned is forearmed", as they say!

[pof]

I guess I'll only get one shot at this, so...
Yes, you're right with your guess :)

Can someone suggest which USB sniffer hasn't been tried yet?
On comment #43 there's a list of programs, most of them have a trial or free version available that should be ok. I only tried HHDsoft USB monitor without success.

If it's going to refuse to play on the basis that a sniffer is found using the USB port, will it complain before it unlocks the phone?
Yes, the imei-check software will give you a "communication error" when USB monitor is running: http://forum.xda-developers.com/files/unlock1.jpg


What I'm trying to establish is if I can try several sniffers in sequence without unlocking the phone 'prematurely' and blowing the opportunity to get a dump.
Ideas on comments #41 and #42 should be the 'way to go' if imei-check's unlocker detects all the USB sniffers.

keep us informed of your progress and feel free to ask if you need any help :-)

[pof]

Looking at \windows\SimLock.exe file I see it is the same file as in HTC Universal. Before the Universal unlocker was released by buzz there was an attempt to bruteforce the unlocking code and 3ppc developed a bruteforcer for all lock types, which you can find here, it should work on the Hermes too (at your own risk!), but the bruteforce attack takes a lot of time:

http://forum.xda-developers.com/showpost.php?p=945962&postcount=565

NOTE: This has nothing to do with buzz's htc universal unlocker, do not use the universal unlocker on the hermes because it will install a patched radio which will make your device unusable!

[nokia8210]

hello all can any one tell me if the m3100 works with imei changer.thanks

[Izzard-UK]

@nokia8210: if you read this thread you'd see that several people have confirmed it works fine.

[Izzard-UK]

I've got my (locked) SPV M3100 now and I'm trying to find the right USB sniffing solution (that I don't have to pay for. So far they've been crippled so you can't save logs, etc).

I'll report back soon.

[Izzard-UK]

Not having too much luck so far. Tried with two of the suggested USB sniffers and these are the results:

1) Test: Sniffer running, starting IMEI-check's unlock app:
Result: Communications error (i.e. it detects something sniffing).

1) Test: Starting IMEI-check's unlock app, letting it find the phone. Then, at the point where it asks for the IMEI-specific unlock file, starting the sniffer:
a) Result: Nothing gets logged by sniffer.
b) IMEI-check's unlock app crashes (scaring the hell out of me).

I'll try another sniffer.

I've tried using Virtual PC but the support for USB devices is limited (as it says) and it doesn't show up in the virtual PC's Device Manager. (And the unlock app running on the Virtual PC can't find the phone).

Running out of ideas soon. There was a mention of getting a dump off the phone before and after I unlock it. If someone can tell me how before I give up and just unlock the thing, that's cool. But I do want to start using my phone soon (i.e. on T-mobile... the Orange SIM that came with the M3100 is now in my T-mobile MDA Vario, which I have given to my wife .. ..OBVIOUSLY!) ;)

[nokia8210]

ok what i ment to ask is is there a imei changer that works on this model iwizard shows wrong imei. model m3100

[Izzard-UK]

Sorry - I assumed you were talking about unlocking a SIM-locked M3100 (because that's what this thread is about).

In other news: no luck sniffing USB data still. I've decided to just unlock it and get on with my life. Sorry all!

[slimsaturn]

Looking at \windows\SimLock.exe file I see it is the same file as in HTC Universal. Before the Universal unlocker was released by buzz there was an attempt to bruteforce the unlocking code and 3ppc developed a bruteforcer for all lock types, which you can find here, it should work on the Hermes too (at your own risk!), but the bruteforce attack takes a lot of time:

http://forum.xda-developers.com/showpost.php?p=945962&postcount=565

NOTE: This has nothing to do with buzz's htc universal unlocker, do not use the universal unlocker on the hermes because it will install a patched radio which will make your device unusable!

POF

Whats this Brute force thing doo. and I am assuming i can brick my phone if something goes ary....I still have yet to receive my phone so the guy i bought it from is going to start tracking it down with royal mail

[fun_key]

Here is a little how-to explaining how to dump what is going on the USB port with USBMON:

What you need befor you start:

USBMON (I used the trial): http://www.hhdsoftware.com/Products/...b-monitor.html
A win 2k/XP computer with admin rights

How to fool the IMEI-CRACK tool:

-Login with the administrator and setup USBMON
-Create with the administrator a user (named wathever you like) with only "user" or "powered user" rights
-Log in with the user you just created (you may have to resetup Active sync with this user; I don't know why but it seems that active sync doesnt setup for all user)
-Right click on the USBMON icon and select "run as"; input the administrator credential and configure the software ready for the capture
-Launch the crack and follow the instruction

And voila ! The dump should be achieved by now

[Izzard-UK]

I wish I'd thought of that yesterday :D

[vijay_kumar]

When we guys expect Free unlocker for u :) Even though i've used imei service to unlock my vario 2 but still i can't cal or/recive calls , JuST I SEE NETWORK SIGNALS :(

[suyar]

i want to pay for sim-unlock by http://www.imei-check.co.uk ,but i have no creditcard and only an account on paypal.de and only transfer euro into my paypal account.does anyone know,how i pay euro by paypal.de for unlock?

[mazta]

man, any ideas how long it will take to get a public unlocker, what can we do to help, i have about ten handets that need unlocking and £200 is a lot, so i'm willing to donate some cash to these guys,

any progress?

what can we do to help?


cheers man

[rsolomon]

what can we do to help?

As earlier posts in this thread have said already - buy ONE unlock from the guys who have it and snoop it....

[Stabilo]

Looking at \windows\SimLock.exe file I see it is the same file as in HTC Universal. Before the Universal unlocker was released by buzz there was an attempt to bruteforce the unlocking code and 3ppc developed a bruteforcer for all lock types, which you can find here, it should work on the Hermes too (at your own risk!), but the bruteforce attack takes a lot of time:

http://forum.xda-developers.com/showpost.php?p=945962&postcount=565

NOTE: This has nothing to do with buzz's htc universal unlocker, do not use the universal unlocker on the hermes because it will install a patched radio which will make your device unusable!

Daft question I know but what does Simlock.exe do?
How long is a long time?

[pof]

Daft question I know but what does Simlock.exe do?

It's the app that asks you for the unlock code when you put a locked sim.

How long is a long time?

I don't know as haven't tried, the unlocking code is a number between 00000000 and 99999999, so there are A LOT of possible combinations... if you are lucky and get it at the 1st try then it's fast, otherwise it can be veeery slow. Watch the full unlocking thread for more details:
http://forum.xda-developers.com/showthread.php?p=945962

[pof]

The imei-check unlocker output has been captured! let the fun begin ;)

http://forum.xda-developers.com/forumdisplay.php?f=306

[ptiga100gene]

nothing yet
my sfr v1605 is down
i hope i will bring alive a day.

[pof]

I finally released a Free SIM-Unlocker for the HTC Hermes, you can find it here:

http://forum.xda-developers.com/showthread.php?t=282073

This thread will remain closed.