[R&D] Unlocking the Galaxy Nexus SIM Lock

shenye · Nov 18, 2011

I'm starting off trying to use Odia's method on nv_data.bin. Haven't been able to find the 5 sets of hashes I need to brute force. Also, the file is not in /efs on the Galaxy Nexus, it's in /factory.

If you would like to help, I've attached the file I'm working on. To be honest, the salt has probably been changed to prevent this method from working

trojjanhorse · Dec 8, 2011

I've been tinkering with the .bin file myself and no luck... i think i may have to buy the code after all. I would much rather pledge my support to a dev who finds a way around this.

bluejet07 · Jan 8, 2012

Hi all,

I have a galaxy nexus which is locked to a specific carrier. I managed to have it rooted and backed up with clockworkmod. I also was able to obtain the unlocked code from the carrier after much difficulty. Vodafone are just really painful.

Anyway, enough of the backstory. The process I carried out to discover something that might help you guys to find the 8 digit pin lives in the /data/radio/nv_data.bin file.
After restoring the rom before the unlocking state , I had to see what the state was state of the files before and after the unlock. I did this many times, until I found that file
was changed, (after greping for timestamp differences etc). As well, I've noticed that when I restored to a backup that had the network unlocked, it would just work when the sim of the other carrier was used. So I assume that there was some files that clockworkmod was restoring which made it unlocked. Who knew that.

When comparing this file before and after the network unlock,
(hexdump both files and did a text diff).
I've noticed that the unlock nv_data.bin had address 0180060 to 0180080
0180060 ffff ffff ffff ffff 35ff 3530 3330 3523
0180070 3530 3630 ff23 ffff ffff ffff ffff ffff
0180080 ffff ffff ffff ffff ffff ffff ffff ffff
removed from the unlocked nv_data.bin file as well as
0181460 ffff ffff ffff ffff 01ff 0000 0000 0442 changed to zero, i.e.
0181460 ffff ffff ffff ffff 00ff 0000 0000 0442

So maybe this is the addresses you can use to unlock your phone or use Odia's method to find the 8 digit code. Or you could just remove these bytes and set that flag to 0 and I assume that will unlock the phone as well.

I was planning to look at Odia's work and see what he used for obtaining the code.
So I see if I have time to look into this. But feel free to let me know if you guys get ahead of me.

wilsonlam97 · Jan 8, 2012

bluejet07 said:
Hi all,

I have a galaxy nexus which is locked to a specific carrier. I managed to have it rooted and backed up with clockworkmod. I also was able to obtain the unlocked code from the carrier after much difficulty. Vodafone are just really painful.

Anyway, enough of the backstory. The process I carried out to discover something that might help you guys to find the 8 digit pin lives in the /data/radio/nv_data.bin file.
After restoring the rom before the unlocking state , I had to see what the state was state of the files before and after the unlock. I did this many times, until I found that file
was changed, (after greping for timestamp differences etc). As well, I've noticed that when I restored to a backup that had the network unlocked, it would just work when the sim of the other carrier was used. So I assume that there was some files that clockworkmod was restoring which made it unlocked. Who knew that.

When comparing this file before and after the network unlock,
(hexdump both files and did a text diff).
I've noticed that the unlock nv_data.bin had address 0180060 to 0180080
0180060 ffff ffff ffff ffff 35ff 3530 3330 3523
0180070 3530 3630 ff23 ffff ffff ffff ffff ffff
0180080 ffff ffff ffff ffff ffff ffff ffff ffff
removed from the unlocked nv_data.bin file as well as
0181460 ffff ffff ffff ffff 01ff 0000 0000 0442 changed to zero, i.e.
0181460 ffff ffff ffff ffff 00ff 0000 0000 0442

So maybe this is the addresses you can use to unlock your phone or use Odia's method to find the 8 digit code. Or you could just remove these bytes and set that flag to 0 and I assume that will unlock the phone as well.

I was planning to look at Odia's work and see what he used for obtaining the code.
So I see if I have time to look into this. But feel free to let me know if you guys get ahead of me.

Would it work if you just reflash the radio when you unlock the bootloader?

bluejet07 · Jan 8, 2012

I've flashed different radios before, but I haven't checked flashing the radio and checking this file. However, I think that is unrelated since the radio firmware remains the same when I restored different versions of my clockworkmod backup and since I can relock the network pin by restoring a early image of the rom. It is probably unrelated.

Anyway, this method will assume you have root privileges. I was more concerned with finding how how to obtain the pin based on these hashes.

Odia · Jan 9, 2012

Method is the same, even the HASHes are in the same location, the nv_data from the OP has the new CRYPTED HASHes like the later SGS2 models, but simply flipping the FLAG @ 0x181469 will work for making unlock without knowing the code.

You could also make it same like a factory unlocked nv_data but I'll let you compare those and work out the method if its something you really want to do but if its just to unlock I have given all the info you need.

bluejet07 · Jan 10, 2012

Yeah, so my diff confirms that. Cool as we already establish that.

But finding the code was really my goal. You know, for people who like revert back to stock but knowing the code.
So it is using some new encrypted hash like the later posts in the sg2 posts. So we have no idea how to brute force it? Yeah I had a look at all your posts and came to the conclusion it looks encrypted differently.
Oh well, maybe in time we can find a way to decrypt it.

Thanks for the reply!

shenye · Jan 10, 2012

Odia, any chance of a request into a bit of research into this? I can provide you with my locked nv_data and my unlock codes. I don't think my nv_data has been updated though as I need to reunlock everytime I wipe...

I assume they're using a salt that's no longer 0000000000000000, so this might be able to brute force the salt string they're using?

jacobtc · Jan 13, 2012

Would be very interested in knowing how to sim unlock the SGN!

Roman2K · Jan 13, 2012

jacobtc said:
Would be very interested in knowing how to sim unlock the SGN!

Add me to the list

. Thanks to shenye, bluejet07 & Odia for working on this.

Mutantz · Jan 13, 2012

bluejet07 said:
Hi all,

I have a galaxy nexus which is locked to a specific carrier. I managed to have it rooted and backed up with clockworkmod. I also was able to obtain the unlocked code from the carrier after much difficulty. Vodafone are just really painful.

Anyway, enough of the backstory. The process I carried out to discover something that might help you guys to find the 8 digit pin lives in the /data/radio/nv_data.bin file.
After restoring the rom before the unlocking state , I had to see what the state was state of the files before and after the unlock. I did this many times, until I found that file
was changed, (after greping for timestamp differences etc). As well, I've noticed that when I restored to a backup that had the network unlocked, it would just work when the sim of the other carrier was used. So I assume that there was some files that clockworkmod was restoring which made it unlocked. Who knew that.

When comparing this file before and after the network unlock,
(hexdump both files and did a text diff).
I've noticed that the unlock nv_data.bin had address 0180060 to 0180080
0180060 ffff ffff ffff ffff 35ff 3530 3330 3523
0180070 3530 3630 ff23 ffff ffff ffff ffff ffff
0180080 ffff ffff ffff ffff ffff ffff ffff ffff
removed from the unlocked nv_data.bin file as well as
0181460 ffff ffff ffff ffff 01ff 0000 0000 0442 changed to zero, i.e.
0181460 ffff ffff ffff ffff 00ff 0000 0000 0442

So maybe this is the addresses you can use to unlock your phone or use Odia's method to find the 8 digit code. Or you could just remove these bytes and set that flag to 0 and I assume that will unlock the phone as well.

I was planning to look at Odia's work and see what he used for obtaining the code.
So I see if I have time to look into this. But feel free to let me know if you guys get ahead of me.

Which program can edit bin-file?
Where is this file placed?

sitajony · Jan 15, 2012

Unlock your Galaxy Nexus whenever your want

Hello, I've bought my Galaxy Nexus on december, 2 weeks later I've finaly found how unlock my phone

I live in france and here we've to buy code and it's very expensive...
"I've made" a Batch script running only on Windows OS but we can see that is a Shell code... (In fact this come from a website in japanese without help and no choice so I've created this batch script)
After downloading, edit it and press CTRL+H then type in first field this:
"C:\Program Files (x86)\Android\android-sdk\platform-tools\adb.exe" and type the ADB path on your PC on the second field. (Keep this if it's the same path)
PRESS CTRL+S and run it...
The first question is:
Restore? (Answers: oui=yes, non=no)
Type "yes" only if you've already tried to unlock and it didn't work...
Finaly wait few minutes and in the last question, you'll can directly reboot your phone without touching your phone

Please tell me if there're problems or if you want ask me some questions...
Good luck!

Roman2K · Jan 15, 2012

@sitajony
Thanks a lot for contributing this Window batch script!

However, I think it's a bit of a mess in there (repetitions, some useless RW remounts, and world-writable permission settings, deletions of files in / that weren't created in the first place). Anyone willing to run it ought to double check every single line beforehand.

From what I understand, the core of it boils down to something like this:

Code:

$ echo -en \\x00 > tmp00 
$ dd if=/factory/nv_data.bin of=tmpff bs=1 count=30 skip=16 
$ dd if=/factory/nv_data.bin of=data1 bs=1 count=1572969 
$ dd if=/factory/nv_data.bin of=data2 bs=1 skip=1572999 count=5090 
$ dd if=/factory/nv_data.bin of=data3 bs=1 skip=1578090 
$ cat data1 tmpff data2 tmp00 data3 > nv_data.bin 
$ md5sum nv_data.bin | tr '\n' 'X' | sed 's/ .*//' > nv_data.bin.md5 
# cp nv_data.bin{,.md5} /data/radio/

So this /factory/nv_data.bin is being split and the pieces re-arranged. Do you have details as to what is being done exactly? And / or the link to the original script on the japanese site?

cristian1975 · Jan 16, 2012

Don't know what is doing, but works. But backup first EFS folder, factory ...
@sitajony - I didn't had cp command in my "nexus" shell, but managed with RootExplorer and rest of the code, thanks.

gaglax · Jan 17, 2012

Roman2K said:
@sitajony
Thanks a lot for contributing this Window batch script!

However, I think it's a bit of a mess in there (repetitions, some useless RW remounts, and world-writable permission settings, deletions of files in / that weren't created in the first place). Anyone willing to run it ought to double check every single line beforehand.

From what I understand, the core of it boils down to something like this:

Code:

$ echo -en \\x00 > tmp00 $ dd if=/factory/nv_data.bin of=tmpff bs=1 count=30 skip=16 $ dd if=/factory/nv_data.bin of=data1 bs=1 count=1572969 $ dd if=/factory/nv_data.bin of=data2 bs=1 skip=1572999 count=5090 $ dd if=/factory/nv_data.bin of=data3 bs=1 skip=1578090 $ cat data1 tmpff data2 tmp00 data3 > nv_data.bin $ md5sum nv_data.bin | tr '\n' 'X' | sed 's/ .*//' > nv_data.bin.md5 # cp nv_data.bin{,.md5} /data/radio/

So this /factory/nv_data.bin is being split and the pieces re-arranged. Do you have details as to what is being done exactly? And / or the link to the original script on the japanese site?

i am planning to switch from stock to cyanogenmod9.
so is it safe to use the script and then flash CM9?

thx

jacobtc · Jan 17, 2012

You use it after flashing the ROM, it uses ADB...

sitajony · Jan 17, 2012

Sorry, I can't answer immediately, I don't remember the website address sorry...
@gaglax Don't run this code, run the batch script else you'll get errors, there're some others lines needed...
You've to run it after any rom flashed if you've deleted the "/data" folder in ClockWorldMod menu...

@Roman2K
Yes it's splitted, we get bytes that we need without informations about unlock state and then write all in "nv_data.bin" file to unlock folder...

I've also noticed that I've some problems with my network, sometime I'm in offline mode, someone else have this problem too?

gaglax · Jan 17, 2012

ok so i flashed cyanogenmod 9 kang.
then replaced the path .. but it always says permission denied.

so i went to settings/debugging and enabled root, adb over networks.
now i cannot get into the phone via adb:

Code:

C:\>"c:\android-sdk\platform-tools\adb.exe" devices
List of devices attached
000000000000        device

C:\>"c:\android-sdk\platform-tools\adb.exe" shell

it just stays there ..

ok i think that adb over network seems somehow broken in the latest kang from here: http://xdaforums.com/showthread.php?t=1398495

Roman2K · Jan 17, 2012

@gaglax
"su" asks for a password before executing a command (or shell) as another user. If "root" doesn't have a password, I believe it prints the "Permissions denied" error you're getting.

To run commands as root with "adb", you should rather start with running:

Code:

$ adb root

This will restart the ADB client process in the background (sort of bridge between the "adb" command and the phone) with root privileges. For that, your phone must be running a build with root access, like a development build (build type full_maguro-userdebug).

Then, to run commands more conveniently than invoking "adb" every time:

Code:

$ adb shell

@sitajony
OK, thanks for the clarifications.

I haven't tried the chopped up + reassembled nv_data.bin yet. I'm all new to Android and even newer to the SDK. Really good stuff, high quality documentation, but I'm going step by step before attempting anything I don't understand fully.

I've tried loading a factory image, thinking that since it replaces the radio flash partition, it would load a clean version of whatever it is the carrier tampered with. Didn't work, still asks for a network unlock code after entering the PIN code.

Next, I'll try your nv_data.bin manipulation, but first I'm building a -userdebug to gain root access.

gaglax · Jan 17, 2012

Roman2K said:
@gaglax
"su" asks for a password before executing a command (or shell) as another user. If "root" doesn't have a password, I believe it prints the "Permissions denied" error you're getting.

To run commands as root with "adb", you should rather start with running:

This will restart the ADB client process in the background (sort of bridge between the "adb" command and the phone) with root privileges. For that, your phone must be running a build with root access, like a development build (build type full_maguro-userdebug).

Then, for to run commands more conveniently than invoking "adb" every time:

@sitajony
OK, thanks for the clarifications.

I haven't tried the chopped up + reassembled nv_data.bin yet. I'm all new to Android and even newer to the SDK. Really good stuff, high quality documentation, but I'm going step by step before attempting anything I don't understand fully.

I've tried loading a factory image, thinking that since it replaces the radio flash partition, it would load a clean, untampered-with version of whatever the carrier locked down. Didn't work, still asks for a network unlock code after entering the PIN code.

Next, I'll try your nv_data.bin manipulation, but first I'm building a -userdebug to gain root access.

cool that was it ..!!

i restarted with:

Code:

adb root

then used the script.
somehow there where some error messages but the galaxy nexus is now sim unlocked.

thx for your help ;-)

[R&D] Unlocking the Galaxy Nexus SIM Lock

Inactive Recognized Developer

Attachments

Senior Member

New member

Senior Member

New member

Guest

New member

Inactive Recognized Developer

Senior Member

Member

Member

Senior Member

Member

Member

Member

Senior Member

Senior Member

Member

Member

Member

Similar threads

Top Liked Posts