[GUIDE][APP Now In Market] Unlock for Samsung Galaxy Tab 10.1 [11-14-11]

Search This thread

dagentooboy

Senior Member
Feb 16, 2008
544
156
Kansas
So I managed to unlock my T-Mobile Tab 10.1 over the weekend and I discovered that it works on ATT at 3.5G speeds.
My Tab has several files in the /efs/ folder that weren't there in my previous Samsung phones.

Unlock App for anyone who doesn't feel comfortable with a hex editor
img.php


BTW... I cannot be held responsible for anything that happens to your phone.... EVER!

Before you start... if you don't have root you WILL need it.

ALSO MAKE SURE YOU HAVE A BACKUP OF THE /efs/ FOLDER


Step 1. - Retrieve nv_data.bin file
use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
cat /efs/nv_data.bin >> /sdcard/nv_data.bin
cat /efs/.nv_state >> /sdcard/.nv_state
busybox cp -r /efs /sdcard/

Step 2. - Edit nv_data.bin file
mount the internal SD Card on your computer
make a backup copy of the nv_data.bin file on your computer
using your favorite HEX editor open the nv_data.bin on the sdcard
jump to address 0x181468

you should see a string like this
ff 01 00 00 00 00
there are 5 different types of locks in 5 different bytes
the FF byte should be left alone
the first byte after the FF is the network lock
the next byte is the network subset lock
the next byte is the sp lock
the next byte is the cp lock
the last byte appears to be a data lock.
the 46 46 should be left alone
Change any 0x01 to 0x00 (or 0x00 to 0x01 to lock for warranty)
It should read ff 00 00 00 00 00 46 46 for unlocked
save and close file
unmount SD Card

Step 3. - Replace nv_data.bin file
I want to say it again so no one misses it MAKE SURE YOU HAVE A BACKUP OF YOUR /efs/ FOLDER BEFORE YOU CONTINUE!!!!!

use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
rm /efs/nv_*
rm /efs/.nv_*
cat /sdcard/nv_data.bin >> /efs/nv_data.bin
cat /sdcard/.nv_state >> /efs/.nv_state
chmod 755 /efs/nv_data.bin
chown radio.radio /efs/nv_data.bin || chown 1001.1001 /efs/nv_data.bin
chmod 755 /efs/.nv_state
chown radio.radio /efs/.nv_state || chown 1001.1001 /efs/.nv_state
reboot
your tab is now unlocked... enjoy :D

If you have any trouble with md5 and IMEI stuff change .nv_state from 0x30 to 0x31 (or ascii 0 to 1)

Give a big thanks to all the people that helped with the original unlock method (in the i9000 thread)

If it works please feel free to donate via Paypal
 
Last edited:

Itaintrite

Senior Member
Feb 10, 2008
1,658
333
New York.
Google Pixel 6 Pro
Don't have a 3G tab but this is cool. I think you should price your app at under $2 to maximize profits. With the fix available for free, a lot of people won't pay for it. But if it's dirt cheap at 99c or $1.99, why not?

Anyway, good job.
 

viaper

Member
Jul 23, 2005
19
0
Hello

Many thanks for the procedure, really waiting for it, but I have on my nv_data.bin the following bytes:

FF 01 00 00 00 00 BC 9D D4

Any clue of what I have to change to?

Thanks again in anycase
 

dagentooboy

Senior Member
Feb 16, 2008
544
156
Kansas
Hello

Many thanks for the procedure, really waiting for it, but I have on my nv_data.bin the following bytes:

FF 01 00 00 00 00 BC 9D D4

Any clue of what I have to change to?

Thanks again in anycase

After you have a backup you can change that first 01 to a 00

FF 00 00 00 00 00 BC 9D D4

and you should be set... I had to delete all those other files in the folder. Could you tell me what files you have in /efs/?

su
busybox ls -la /efs/
 
  • Like
Reactions: tigerfire25

dagentooboy

Senior Member
Feb 16, 2008
544
156
Kansas
Don't have a 3G tab but this is cool. I think you should price your app at under $2 to maximize profits. With the fix available for free, a lot of people won't pay for it. But if it's dirt cheap at 99c or $1.99, why not?

Anyway, good job.

I have always believed in providing the solution to everyone... I don't want anyone to think I am only in this for the money. When I was looking for the i9000 unlock someone was charging $35 and there was no way I was going to pay that so I started on this path of providing the information for free.

Thanks to the economy I lost my job and had lots of time to code but no money for devices.... enter the PRO app. I get a lot of people that buy codes and then they don't work and they end up using my app for half the price (half the time the samsung unlock doesn't work even with the code).
 
  • Like
Reactions: tigerfire25

viaper

Member
Jul 23, 2005
19
0
Hi dagentooboy

Going to test ASAP, many thanks for the quick answer, find here the result of the command:

busybox ls -la /efs/
total 5168
drwxrwx--x 6 1001 1000 4096 Oct 26 06:26 ←[1;34m.←[0m
drwxrwxrwx 15 0 0 0 Nov 6 07:51 ←[1;34m..←[0m
drwxrwxr-x 5 0 0 4096 Jan 1 2011 ←[1;34m.files←[0m
-rwx------ 1 1001 1001 1048576 Dec 31 2010 ←[1;32m.nv_core.bak←[0m

-rwx------ 1 1001 1001 32 Dec 31 2010 ←[1;32m.nv_core.bak.md5
←[0m
-rwx------ 1 1001 1001 2097152 Dec 31 2010 ←[1;32m.nv_data.bak←[0m

-rwxr-xr-x 1 1001 1001 32 Dec 31 2010 ←[1;32m.nv_data.bak.md5
←[0m
-rw-rw-rw- 1 1001 1001 1 Dec 31 2010 ←[0;0m.nv_state←[0m
drwxrwxr-x 2 1001 1001 4096 Jan 1 2011 ←[1;34mbluetooth←[0m
drwxrw-r-- 2 1000 1000 4096 Aug 23 03:25 ←[1;34mgyro←[0m
drwxrwxr-x 2 1001 1001 4096 Aug 23 03:31 ←[1;34mimei←[0m
-rw-rw-rw- 1 1001 1001 2210 Oct 22 21:21 ←[0;0mnv.log←[0m
-rwx------ 1 1001 1001 2097152 Nov 6 07:52 ←[1;32mnv_data.bin←[0m
-rwxr-xr-x 1 1001 1001 32 Nov 6 07:52 ←[1;32mnv_data.bin.md5←
[0m
-rwxrw-r-- 1 1001 1001 880 Dec 31 2010 ←[1;32mredata.bin←[0m
root@android:/ #
 

NiN39Z

Senior Member
Dec 5, 2007
136
9
How did u root the tmobile galaxy tab 10.1 4g? I been looking for a guide and couldnt find one to root this. Someone point me to the right direction please?
 

dagentooboy

Senior Member
Feb 16, 2008
544
156
Kansas
What I did is just follow the instructions in the Overcome rom except the "re-stocking" part. Mine is running Overcome with no problems so far.
 
  • Like
Reactions: tigerfire25

dagentooboy

Senior Member
Feb 16, 2008
544
156
Kansas
Hi dagentooboy

Going to test ASAP, many thanks for the quick answer, find here the result of the command:

busybox ls -la /efs/
total 5168
drwxrwx--x 6 1001 1000 4096 Oct 26 06:26 ←[1;34m.←[0m
drwxrwxrwx 15 0 0 0 Nov 6 07:51 ←[1;34m..←[0m
drwxrwxr-x 5 0 0 4096 Jan 1 2011 ←[1;34m.files←[0m
-rwx------ 1 1001 1001 1048576 Dec 31 2010 ←[1;32m.nv_core.bak←[0m

-rwx------ 1 1001 1001 32 Dec 31 2010 ←[1;32m.nv_core.bak.md5
←[0m
-rwx------ 1 1001 1001 2097152 Dec 31 2010 ←[1;32m.nv_data.bak←[0m

-rwxr-xr-x 1 1001 1001 32 Dec 31 2010 ←[1;32m.nv_data.bak.md5
←[0m
-rw-rw-rw- 1 1001 1001 1 Dec 31 2010 ←[0;0m.nv_state←[0m
drwxrwxr-x 2 1001 1001 4096 Jan 1 2011 ←[1;34mbluetooth←[0m
drwxrw-r-- 2 1000 1000 4096 Aug 23 03:25 ←[1;34mgyro←[0m
drwxrwxr-x 2 1001 1001 4096 Aug 23 03:31 ←[1;34mimei←[0m
-rw-rw-rw- 1 1001 1001 2210 Oct 22 21:21 ←[0;0mnv.log←[0m
-rwx------ 1 1001 1001 2097152 Nov 6 07:52 ←[1;32mnv_data.bin←[0m
-rwxr-xr-x 1 1001 1001 32 Nov 6 07:52 ←[1;32mnv_data.bin.md5←
[0m
-rwxrw-r-- 1 1001 1001 880 Dec 31 2010 ←[1;32mredata.bin←[0m
root@android:/ #

I am not sure what the nv_core is so make sure you have a backup of that. If someone gets it unlocked without deleting that let me know.
 

stupsi99

Member
Mar 31, 2007
35
0
I unlock my phone with your Manual - IT works.
After you restart your unlocked phone the md5 file will be generated automaticaly.
Now you can copy all your backuped files back.

Phone search .Md5 file - if exist then the nv_data.bin Is used.
I have now working and unlocked phone. And all files back.

Sent from my GT-P7500 using xda premium
 

dagentooboy

Senior Member
Feb 16, 2008
544
156
Kansas
I unlock my phone with your Manual - IT works.
After you restart your unlocked phone the md5 file will be generated automaticaly.
Now you can copy all your backuped files back.

Phone search .Md5 file - if exist then the nv_data.bin Is used.
I have now working and unlocked phone. And all files back.

Sent from my GT-P7500 using xda premium

So what if we simply

rm /efs/*.md5??? I think that might work.
 

stupsi99

Member
Mar 31, 2007
35
0
Not work! If No md5 file - sw generate from inside files, Not from unlocked nv_data.bin file.
If you delete all nv_..... files and Put unlocked nv_data.bin inside - System use your file To generate md5
After that you can give all deleted files back.

Testet on sgs2 to.

Sent from my GT-P7500 using xda premium
 
Last edited:

masterludo

Member
Apr 23, 2010
43
1
Great work! I'll take a look tomorrow at my efs directory and files, but do you think this could also work on a GT 8.9?
Will let you know if I try it out.
 

masterludo

Member
Apr 23, 2010
43
1
This is awesome, thanks a lot dagentooboy!!!
This works like a charm with the GT 8.9 3G (French, locked on Orange), exactly the same steps.
 

dagentooboy

Senior Member
Feb 16, 2008
544
156
Kansas
Does anyone have the T-Mobile tab 10.1? I please email me so I can get a full system dump. It has to be the T-Mobile version.
 

doaneramma

Senior Member
Feb 3, 2007
260
33
Saanich, BC
as was an issue on the i9000m I'm running into the deleted imei. Lol. Good thing I backed up my efs (this is me reiterating BACK IT UP!). The device still works but any chance of warranty is toast if this back up fails.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 22
    So I managed to unlock my T-Mobile Tab 10.1 over the weekend and I discovered that it works on ATT at 3.5G speeds.
    My Tab has several files in the /efs/ folder that weren't there in my previous Samsung phones.

    Unlock App for anyone who doesn't feel comfortable with a hex editor
    img.php


    BTW... I cannot be held responsible for anything that happens to your phone.... EVER!

    Before you start... if you don't have root you WILL need it.

    ALSO MAKE SURE YOU HAVE A BACKUP OF THE /efs/ FOLDER


    Step 1. - Retrieve nv_data.bin file
    use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
    Code:
    su
    cat /efs/nv_data.bin >> /sdcard/nv_data.bin
    cat /efs/.nv_state >> /sdcard/.nv_state
    busybox cp -r /efs /sdcard/

    Step 2. - Edit nv_data.bin file
    mount the internal SD Card on your computer
    make a backup copy of the nv_data.bin file on your computer
    using your favorite HEX editor open the nv_data.bin on the sdcard
    jump to address 0x181468

    you should see a string like this
    ff 01 00 00 00 00
    there are 5 different types of locks in 5 different bytes
    the FF byte should be left alone
    the first byte after the FF is the network lock
    the next byte is the network subset lock
    the next byte is the sp lock
    the next byte is the cp lock
    the last byte appears to be a data lock.
    the 46 46 should be left alone
    Change any 0x01 to 0x00 (or 0x00 to 0x01 to lock for warranty)
    It should read ff 00 00 00 00 00 46 46 for unlocked
    save and close file
    unmount SD Card

    Step 3. - Replace nv_data.bin file
    I want to say it again so no one misses it MAKE SURE YOU HAVE A BACKUP OF YOUR /efs/ FOLDER BEFORE YOU CONTINUE!!!!!

    use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
    Code:
    su
    rm /efs/nv_*
    rm /efs/.nv_*
    cat /sdcard/nv_data.bin >> /efs/nv_data.bin
    cat /sdcard/.nv_state >> /efs/.nv_state
    chmod 755 /efs/nv_data.bin
    chown radio.radio /efs/nv_data.bin || chown 1001.1001 /efs/nv_data.bin
    chmod 755 /efs/.nv_state
    chown radio.radio /efs/.nv_state || chown 1001.1001 /efs/.nv_state
    reboot
    your tab is now unlocked... enjoy :D

    If you have any trouble with md5 and IMEI stuff change .nv_state from 0x30 to 0x31 (or ascii 0 to 1)

    Give a big thanks to all the people that helped with the original unlock method (in the i9000 thread)

    If it works please feel free to donate via Paypal
    1
    Hello

    Many thanks for the procedure, really waiting for it, but I have on my nv_data.bin the following bytes:

    FF 01 00 00 00 00 BC 9D D4

    Any clue of what I have to change to?

    Thanks again in anycase

    After you have a backup you can change that first 01 to a 00

    FF 00 00 00 00 00 BC 9D D4

    and you should be set... I had to delete all those other files in the folder. Could you tell me what files you have in /efs/?

    su
    busybox ls -la /efs/
    1
    Don't have a 3G tab but this is cool. I think you should price your app at under $2 to maximize profits. With the fix available for free, a lot of people won't pay for it. But if it's dirt cheap at 99c or $1.99, why not?

    Anyway, good job.

    I have always believed in providing the solution to everyone... I don't want anyone to think I am only in this for the money. When I was looking for the i9000 unlock someone was charging $35 and there was no way I was going to pay that so I started on this path of providing the information for free.

    Thanks to the economy I lost my job and had lots of time to code but no money for devices.... enter the PRO app. I get a lot of people that buy codes and then they don't work and they end up using my app for half the price (half the time the samsung unlock doesn't work even with the code).
    1
    What I did is just follow the instructions in the Overcome rom except the "re-stocking" part. Mine is running Overcome with no problems so far.
    1
    i´ve followed all steps. its pretty the same like the other devices like the gt p-1000. full success.