[CLOSED] Galaxy Note 3, Note 2, S4, S3, and S2 Flash to Boost, Virgin Mobile, Ting, etc.

Frequently Asked Questions (FAQ):

Q: Where do I get the Samsung Galaxy Note 2 USB drivers?
A: http://www.samsung.com/us/support/owners/product/SPH-L900TSASPR#software (then click on the "Manuals & Downloads" tab, then click on "Software" tab and click on EXE button).


Q: How do I put my Sprint phone in Diag mode? See post #4 for Verizon phones.
A: Do the following:
1) Launch the phone app.
2) Dial ##3424#
3) Choose PDA
4) Click on "Qualcomm USB Setting"
5) Choose "DM+MODEM+ADB"
*** Note to yourself ***
Do not forget to put it back to "MTP+ADB" after you have successful flashed your Note 2!
6) Done


Q: How do I configure DFS to add the serial port where your phone is connected?
A: Do the following:
1) Install the Note II USB drivers.
2) Put the Note II in Diag mode.
3) Connect the Note II to your PC via USB cable.
4) Launch DFS.
5) Click on Ports. The DFS Port Manager window shows up.
6) Double click on the COM port where it says "SAMSUNG Mobile USB Serial Port".
7) Close the DFS Port Manager window.
8) Done.


Q: How do I get my MSL from my Sprint phone? Verizon phone MSL is 6 zeros.
A: Use "Get My MSL" app from the Play Store
1) Download and install the app.
2) Launch the phone app and dial ##3282#
3) Choose edit.
4) Enter any 6 digits and hit OK.
5) Launch the "Get My MSL" app
6) Click on "Get My MSL" button.
7) Done.


Q: How do I get my MSL if the above method doesn't work (especially applies to Sprint Galaxy S4 & Note 3)
A: Download "Android MSL Reader" from here: http://tools.flashingtools.com/


Q: Is there any other way to get MSL on ANY Sprint phone with clean ESN?
A: The answer is obvious, and sometimes it's so obvious that we forget we can get the MSL by calling Sprint if you have a Sprint account. Tell them you want to donate your (insert your phone make/model here) to someone, but you want to completely factory reset the phone first, ie. run ##786# so you need to get the MSL in order to do so. I've never tried this with a bad ESN phone...who knows, they may give it to you, too. But I don't want to risk getting red flagged for owning and asking about a bad ESN phone.


Q: What is the Samsung password? (thanks to sedds89 and trim81: http://xdaforums.com/showpost.php?p=41478328&postcount=711)
A: Sprint Samsung Galaxy phones: 01F2030F5F678FF9 or 2012112120131219
A: Verizon Samsung Galaxy phones: 2009031920090615
A: US Cellular Samsung Galaxy phones: 2010031619780721


Q: Neither one of the Sprint Samsung Galaxy passwords worked on the Sprint Note 2. Now what?
A: Downgrade your Sprint Note 2's radio/baseband to LJC. The LJC radio works fine with newer ROMs. Put the current radio back after successful flash if so desired.


Q: Where can I download the different radio/basebands for my phone?
A: Sprint Note 2: http://xdaforums.com/showthread.php?t=2139889
A: Sprint Note 3: http://xdaforums.com/showthread.php?p=50963265


Q: Where do I enter my phone's MSL and Samsung password in DFS?
A: At the upper left hand corner of DFS, look for "SPC" and enter your MSL here, then press the SPC button. Enter the password in the "Pwd" field and press Pwd button.


Q: How do I backup my Sprint Galaxy phone's NV Item 1192 (Profile 0's 32 character AAA password)? You may be able to get your "other phone's" NV Item 1192 (AAA key) using this method as well (I have not tried).
A: Use DFS v4.6.4.1 (or newer):
1) Click on EFS tab.
2) Click on Read EFS2.
3) Expand the folder tree.
4) Look for "nvm" and expand that branch.
5) Right click on "num" and choose "Save as..."
6) Choose a folder on your PC to save it to.
7) Once saved, go to that folder and look for 1192 to verify it.
8) Use a hex editor/viewer such as "HxD Hex Editor" to view it.
9) Done.


Q: I forgot to backup my Sprint Galaxy phone's AAA key, how do I put the original key back in the phone?
A: Use DFS v4.6.4.1 (or newer):
1) Put original MEID back.
2) Reboot the phone.
3) Dial ##786#
4) Put in your MSL
5) Confirm the reset
6) This wipes everything on the phone and puts your original AAA key (NV Item 1192) back.


Q: How do I get my Profile 0's 32 character AAA key (NV Item 1192) from my "other" phone using CDMA Workshop 2.7?
A: Do the following:
1. You can google where you can get CDMA Workshop 2.7
2. Put your phone in diagnostic mode. Typically, dial ##3424# (and you may need to choose a menu item to put the phone in DIAG mode).
3. Install the necessary diagnostic drivers for your phone.
4. You can use QPST to determine the COM port of your phone as described in the first few pages of this thread.
5. Launch CDMA Workshop.
6. In "COM Settings", choose the COM port you got from step 3.
7. Click on the "Connect" button. Then click on the "Read" button.
8. Click on the "Security" tab.
9. Enter your phone's 6 digit MSL, then click on the "SPC" button.
10. Click on the "Memory" tab.
11. On the "NV Items" section, click on the "Read" button.
12. Type in "1192" for both "First NV Item" and "Last NV Item" fields, then click on the "OK" button.
13. Save the resulting text file to a folder in your PC you can remember easily.
The resulting output will look like this:
[NV Items]
[Complete items - 1]

1192 (0x04A8) - OK
10 84 3E 7F F6 B8 13 35 7D 30 E0 CE 78 79 7D 93
E7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Your AAA key starts after the "10" and ends right below the "10". In this case, it's:
84 3E 7F F6 B8 13 35 7D 30 E0 CE 78 79 7D 93 E7

When you use this key, make sure you remove the blank spaces, the resulting key is:
843E7FF6B813357D30E0CE78797D93E7
13. Done.

This method of getting Profile 0's 32 character AAA key has been tried and tested on the following:
A) HTC Touch Diamond
B) HTC Touch Pro
C) HTC Touch Pro2
D) Palm Centro
E) Palm Treo Pro
F) Motorola Q9c

You can get AAA key w/o doing steps #8 and #9 above, ie w/o an MSL, if you have an HTC Touch Pro2. I wouldn't be surprised if the same is true for the Touch Diamond and Touch Pro as well.


Q: How do I get my "other" phone's 6 character Profile 1 AAA password?
A: Follow mentioned methods above. Look for NV Item 466 or 466_1.
A: For Windows Mobile phones:
1. Dial ##3282#
2. Choose Edit
3. Enter MSL code
4. Look for "AAA Shared Secret(HEX)". Password should be 6 characters long.



Q: What version of DFS do I need?
A: The free version of DFS v4.6.4.1 (or newer) worked fine. Donate a little something to them, however!!! http://www.cdmatool.com/


Q: What ROM can I use before doing this flashing exercise?
A: Generally speaking, a non rooted or rooted stock ROM will work. For the Sprint Note 2, I used this stock rooted LJC ROM -> SPH-L900_LJC_Root_Restore.exe found here: http://xdaforums.com/showthread.php?t=2032924 I downloaded from Mirror 1 and it matched the MD5. The MD5 in Mirror 2 didn't match...avoid that.


Q: Is root required to do this?
A: No.


Q: On Sprint phones, dialing *2 (launches Sprint Zone app) doesn't show "Activate Device" or "Activate Phone". How do I force a Profile 1 update? How can I activate the phone via WiFi?
A: Do the following:
1) Dial ##yourMSL#
2) Put 10 zeros in the phone/MDN and MSID fields.
3) Save the changes.
4) Reboot phone.
5) Connect to wifi.
6) Dial *2, then activate.
7) Done.


Q: How do I install TWRP on my Galaxy phone? The steps below may be obsolete depending on the ROM version you have. I recommend going to your phone's Development Section here in XDA to find the most current method.
A: This requires a rooted ROM.
1) Install GooManager from the Google Play Store.
2) Once installed, launch GooManager.
3) Grant GooManager root privileges.
4) Press the MENU button on the phone, then choose "Install OpenRecoveryScript"
5) Confirm the installation.
6) Confirm the download.
7) To launch TWRP, do ONE of the following:
a) Launch GooManager. Choose "Reboot recovery"
b) Power down your phone. Press Volume Up, Home, and Power buttons at the same time. When you see the Samsung logo, let go of the buttons.
c) If you have adb command line installed on your PC & USB Debugging enabled on your phone, connect phone via USB cable to PC, then type "adb reboot recovery" on PC.
8) Done.


Q: I have non-rooted or rooted Sprint Note 2 LJC/LK8/MA5/MA7 ROM. I'm getting Hands Free Activation error or Profile Update doesn't work after flashing and rebooting the phone. How do I fix this?
A: Flash this file via TWRP for LK8/MA5/MA7: http://www.mediafire.com/?4fx25prxv2790c6 OR this file for LJC: http://www.mediafire.com/?eyqlje2hclw6jb9
Both files are from http://xdaforums.com/showpost.php?p=36181746&postcount=103 ( Thanks to Mudduq for the heads up. Thanks to garwynn for the fix! )
1) Save the file linked at mediafire or the one attached in that post either in internal or external SD card in your phone.
2) Install the zip file via TWRP.
3) Reboot the phone.
4) Done.




More to come...

Q: Where can I get the latest PRL for Sprint, Boost, and/or Virgin Mobile?
A: Sprint PRL: http://xdaforums.com/showthread.php?t=1880781
A: Boost/Virgin Mobile PRL: http://xdaforums.com/showthread.php?t=1707611 & http://xdaforums.com/showpost.php?p=28879299&postcount=14


Q: How can I install PRL's on my phone?
A: Install "PRL Helper" app found here: http://xdaforums.com/showthread.php?t=2476283


Q: I can't send out MMS! How do I fix it?
A: Sprint / Boost / Virgin Mobile MMS Fix: http://xdaforums.com/showthread.php?t=1794956
Use any of the 3 methods for Sprint phones. Use method 2 for Verizon phones.


Q: Can I use my flashed phone in other countries where cell phone service providers use GSM?
A: Sprint Note 2 - Yes. You lose 4G LTE after doing this mod, but since flashed Note 2's don't have LTE anyway ( as of yet ), might as well mod it to allow you to use your phone when you travel overseas. Have a look at this thread: http://xdaforums.com/showthread.php?t=1959005
A: Sprint S4 - Yes. http://xdaforums.com/showthread.php?t=2415587
A: Sprint Note 3 - Yes. You have to call Sprint to perform a SIM Unlock via OTA.
A: Verizon Note 2, Note 3, S4 - Yes. These phones are globally unlocked out of the box!

You will also need to replace your APN config settings to put in the GSM carrier's Internet and MMS settings. Follow the MMS fix thread mentioned above, but instead of using the APN config files in that thread, use the appropriate one below:

Sprint & International APN Settings - https://www.box.com/s/e883o8z5b86tclogb2rs
Boost & International APN Settings - https://www.box.com/s/28ucwnjdi2rb3ptfga9h
Virgin Mobile & International APN Settings - https://www.box.com/s/k6shgkx6039cwu6cavp9

These XML files already include a bunch of overseas GSM providers. View it to make sure your GSM provider's APN settings are already there. If not, simply edit the file using a text editor like Notepad or Wordpad. You only need to do this once. You don't even have to put back your original APN settings file since the XML's contain Sprint/Boost/Virgin Mobile and international APN settings.


Q: Which modems/basebands will allow me to use my Sprint Note 2 in other countries?
A: LJ1, LJC and LK8 (thanks to eliasmanu for testing!)



Q: How do I disassemble/reassemble my Note 2 to install the SIM card GSM mod mentioned above?
A: Follow this video: https://www.youtube.com/watch?v=UT-2zrZ_aNo


Q: Where can I download modems/basebands from?
A: Sprint Note 2 - http://xdaforums.com/showthread.php?t=2139889
A: Sprint Note 3 - http://xdaforums.com/showthread.php?p=50963265


Q: I'm getting Error 16 when I make a phone call. How do I fix that?
A: Call Sprint/Boost/Virgin Mobile customer support. Tell them you're getting an Error 16. Request for a "CHLS Refresh". More details here: http://xdaforums.com/showthread.php?t=1194460


Q: "Update Profile" and/or "Update PRL" doesn't work on the Sprint Galaxy S4 and Sprint Galaxy Note 3. How do I fix this?
A: Do the following:
1) Follow the flashing exercise as outlined in the first post.

2) Before you reboot the phone, go to the NAM tab.

3) Under the "IMSI" section (not "IMSI T"), you will need to manually populate the "MIN A" and "MIN D" fields using your account's MIN. If you don't know your MIN, just put your cell phone's 3 digit area code in the 1st field and your cell phone's 7 digit number in the 2nd field. Do this for both "MIN A" and "MIN D".

4) For "MCC", type 310. For "MNC", type 00 (still checking MNC)

5) For "MDN" and "PCS" fields, put your 10 digit cell phone number.

6) Under the "Detail" section, put a check mark on "NAM Lock", then remove the check mark. Leave check marks on "Otapa", "SID term", "NID term", and "Home term".

7) Click on Write button.

8) Reboot the phone.

9) Go back to DFS and double check the values you entered in the NAM tab. Most importantly...there shouldn't be a check mark on "NAM Lock". If there is, remove the check mark, write the values, and reboot again.

10) Perform an "Update Profile" and/or "Update PRL".

11) If you put a wrong value on the MIN and/or MDN fields, running "Update Profile" will automatically correct it for you.

12) Done.


Q: I've tried all the steps above and I still can't get Update Profile / Update PRL on Sprint Samsung Galaxy S4's and Note 3's. What do I do next?
A: Do this: http://xdaforums.com/showthread.php?p=49860983


Q: How do I remove the "No SIM" notification from the Galaxy S4 and Note 3?
A: You need to be rooted to do this. Append the following lines in the phone's /system/build.prop:


Q: I wrote values to my target phone, but when I read it, it's not working or I'm not getting the values back that I wrote.
A: That's ok. It's writing as long as the log says it wrote successfully. You may or may not be able to read the values back, but trust your logs... It has been written to your phone if it says so. This applies to ANY Sprint/Verizon Samsung Galaxy phone. This being said, if you're reading values from your "other phone" and writing directly to your target phone via DFS...if DFS can't read your "other phone", then it's not writing correct values to your target phone. That is why I highly advise against this practice and instead you need to know what you need to write to your target phone and write it to your target phone manually so that you know exactly what you're writing.

Q: What info/steps do I need to flash a Verizon Galaxy S3, S4, Note 2, or Note 3 to Sprint, Boost, or Virgin Mobile?
A: Do the following:
1) Removing the SIM card (if any) from the phone is the first thing you should do!

2) Put phone in Diagnostic Mode using Verizon's dialer code. Most, if not all, of Sprint's dialer codes won't work on Verizon phones. See FAQ below for instructions.

3) All Verizon phones' MSL/SPC is 000000. If you're flashing a Sprint branded phone, enter your phone's MSL here.

4) Use the new Samsung Verizon password which is 2009031920090615 if you have a newer modem/baseband. Otherwise, try the old Samsung generic password 01F2030F5F678FF9 for older modem/baseband. The passwords mentioned in this step is for Verizon only. See post #2 for the Sprint Samsung passwords.

5) In DFS, do the following:

6) Click on "General" tab.

7) On "Ruim Config" field, change it from "RuimOnly" to "NV_ONLY" and press the Write button. Reboot the phone.

8) Click on "NAM" tab.

9) Under the "Detail" section, put a check mark on "NAM Lock", then remove the check mark. Leave check marks on "Otapa", "SID term", "NID term", and "Home term". No check marks in other boxes. Reboot the phone. Repeat this step if changes didn't take effect after rebooting.

10) Under the "IMSI" section (not "IMSI T"), you will need to manually populate the "MIN A" and "MIN D" fields using your account's MIN.

11) For "MCC", type 310. For "MNC", type 00 (still checking MNC)

12) For "MDN" and "PCS" fields, put your 10 digit cell phone number.

13) Under the "Network Identification" section, only modify the first row in the "Home" section. Change the "SID" to 4139 and "NID" to 65535. The rest of the rows should be 0's in both columns.

14) Click on "Write" button.

15) Click on the "Data" tab.

16) Fill out the "Account settings" field the same way as described in the very first post of this thread.

17) Under the "Data Config" section, the only fields that should have check marks are "SCRM enabled", "EVDO Antenna RX Control".

18) Under the "EVDO SCP" option section, there should be NO check marks except for "Active config".

19) Click on the "Mobile" tab.

20) Under the "DS QcMIP" section, click on the drop down list box and choose "MobileIP"

21) Under "Profile settings", assign the following:
a) "Active profile" -> 1
b) "Number of profiles" -> 6

22) Under "Registration settings", assign the following:
a) "Retries count" -> 1
b) "Pre-reg timeout" -> 30
c) "Retries interval" -> ms2000

23) Under the "Settings", put a check mark on "Dormant handoff" only.

24) Go back to the first post in this thread to configure Profile 0, and follow steps #11 through #14 in the Sprint & Boost section or Virgin Mobile section.

25) You will also need to manually configure Profile 1 for Sprint and Boost. For Virgin Mobile, you're done.

26) Select the second Profile radio button (this should turn green when enabled), this is Profile 1.

27) On the Selected Profile settings section:
NAI: YourSprintUsername@sprintpcs.com (Sprint)
Home address: 0.0.0.0
Prim HA address: 255.255.255.255
Sec HA address: 68.28.57.76 or 68.28.153.76 (either one works)
MN HA SPI set: (checked) 1234
MN AAA SPI set: (checked) 1234
Reverse Tunneling Pref: (checked)
AAA Shared Secret: enter your 6 character AAA password (remove check mark on "Enter value in HEX")
HA Shared Secret: secret (remove check mark on "Enter value in HEX")

28) Click on "Write current profile settings" button.

29) Install appropriate PRL for your provider. See FAQ in post #3.

30) Install appropriate APN settings for your provider. See FAQ in post #3.

31) Done.



Q: How do I put a Verizon Galaxy S3 or Verizon Note 2 in Diagnostic Mode?
A: Do the following:
1) Launch phone app, and dial *#22745927
2) Press "Hidden Menu Disabled"
3) Choose "enable" and press OK button
4) Press Home button
5) Launch phone app, and dial **87284
6) Press "Qualcomm USB Setting"
7) Choose "DM+Modem+ADB"
*** Note to yourself ***
Do not forget to put it back to "MTP+ADB" after you have successfully flashed your Verizon GS3 or Note 2!
If or when you reboot your phone, it is no longer in Diagnostic Mode.
8) Done


Q: How do I put a Verizon Galaxy S4 or Verizon Note 3 in Diagnostic Mode?
A: Do the following:
1) Launch phone app, and dial ##DMMODE# or ##366633#
2) Choose "Enable DM Mode"
*** Note to yourself ***
Do not forget to put it back to "Disable DM Mode" after you have successfully flashed your Verizon S4 or Note 3!
3) Done


Q: I've done the flashing exercise above for my Verizon Galaxy phone. 3G still doesn't work. How do I fix it?
A: Check the following:
1) Your Profile 0 AAA password (32 characters) and Profile 1 AAA password (6 characters) are accurate. HA password for both Profile 0 and 1 is the word "secret".
2) You may have to install an inactive SIM card on your phone to get 3G to work. I know a T-Mobile SIM card works great.
3) Make you setup your APN settings.


Q: Will my flash get undone if I do a factory reset from within Touchwiz?
A: YES! If you do a factory reset from within Touchwiz, your flash will partially get undone. It will change back to RUIM plus remove NAM settings. So if you need to factory reset, do it before the flashing exercise. Otherwise, be prepared to reflash.
A: NO! If you do the factory/data reset from within Safestrap/TWRP your flash will not get undone. However, I noticed that a reset done through Safestrap doesn't wipe contents of internal SD card by design (since there are ROM slots that will be wiped out). It only wipes settings and apps, therefore, you will have orphan files. You'll have to remove them manually.


Q: I've flashed my Verizon Note 3 to Sprint SERO, Sprint legacy account, Boost, etc., now, I can no longer connect to AT&T, T-Mobile or any GSM network overseas. AlpineMan...I thought you said Verizon phones are globally unlocked?! What's going on here and how do I connect to GSM networks?
A: Starting with the Note 3, Samsung Galaxy phones now have security in place that verifies the signature of the content of the EFS data partition. When you flash the Note 3 to Boost (or whatever), this changes the content of the partition, and thus you will experience a Cert Fail since the signature no longer matches. If you want to connect your phone to GSM, you simply have to get the signature to match again. To do so, flash the original Verizon Note 3 MEID back on the phone and revert RUIM Config from NV_ONLY to RuimOnly then reboot. After rebooting, change your phone's network mode from CDMA/LTE to GSM/UMTS. The steps involved to do the Ruim Config switch process is covered in the beginning of post #4 titled, "Q: What info/steps do I need to flash a Verizon Galaxy S3, S4, Note 2, or Note 3 to Sprint, Boost, or Virgin Mobile?" This has been tested on stock Verizon Note 3 leaked KitKat ROM w/ NC2 modem found here: http://xdaforums.com/showthread.php?t=2726558

Had two LG G3 phones come by the shop today. One let me go right into diag and enable it, and the other asked for a SPC code before enabling it of course... The dialer code to get the SPC as a toast notification didn't work so I went to the good ole adb logcat.

I noticed something familiar- D/QcrilMsgTunnelSocket( 1646): [1192] < OEM_HOOK_RAW [06000000373730393137]

I tried plugging in the last 6 digits (393137), but that obviously wasn't it. Stupid brainfart. I then recognized the pattern of 3's. Take the numbers after the 3's and you've got a 6 digit code. The SPC. In this case mine is 770917 (3[7]3[7]3[0]3[9]3[1]3[7])