[GUIDE] How to get xoom cdma version running on other CDMA EvDO network

---

（There may be something missed in the following steps. if u got problem, feel free to feedback）

It works on Xoom CDMA 3.0/3.1 version.
after upgrade to 3.1, the pppd configuration file was reset , so we should redo step 2.13 to get 3G connection

1.Preparing

1.1 AN & AAA
AN & AAA can be understood as the user name and password of EvDO network.
AN： you can get AN from your phone through cdmaworkshop or QPST or QXDM。
AAA：you can get AAA from some phone by using cdmaworkshop，such as HTC EVO 4G。maybe you can get AAA from provider also.
in this post, i assume the AN is "460030123456789@mycdma.cn".

1.2 SID & NID
System ID & Network ID of provider, which can be found by search engine.

1.3 Tools
installing cdmaworkshop and "HW virtual serial port"(HWVSP) on Windows OS.
In HWVSP, uncheck the "nvt enabled" option to disable nvt(Network Virtual Terminal, rfc2217), or you would be unable to connect to xoom. (thanks lesjaw for pointing this out)
If you can read chinese, I would prefer VSPM instead of HWVSP to create virtual serial port, because VSPM is much faster.
It has free version, can be download at http://www.powerip.net/product_VSPM.htm.

1.4 important tips
before the change, write down or backup the original data for recovering case

2.Hacking

2.1 switching xoom to DIAG mode
hold on VOL-UP & VOL_DOWN button, then press power button for about 5 seconds, until you see the following text on the upper-left corner:

Powering on BP
Cold-booting Linux
Reading ODM fuse:1

(PS: you can do this at any time, no need to turn off xoom.)

2.2 making xoom and Windows PC connected
Method 1：through USB cable
after connecting xoom and PC by USB cable, you could get a network card named "Motorola USB Networking Driver", and the PC would get IP 192.168.16.1, xoom get IP 192.168.16.2

Method2：through WiFi
Connect xoom & PC to the same WiFi network.

2.3 creating DIAG port on Windows PC
run "HW virtual serial port" or other virtual port tool , create a virtual serial port to
IP：192.168.16.2(USB Method) or XXX.XXX.XXX.XXX(xoom WiFi address）
port： 11008

2.4 connect to diag port
run CDMAWorkshop, or other crack tool ,such as QPST, select the virtual serial port created at step 2.3 as DIAG port.


2.5 write PRL
write the correct PRL into xoom by using CDMAWorkshop or other crack tool.

2.6 change MDN
Dir_Number(MDN):change Dir_Number to the first 10 digits of AN

you can also change MDN at step 2.12.

2.7 change AN
we can not modify AN through CDMA workshop or QPST directly.
to changing AN, we have to write some NV items, including 8040,8041,8042,8043,8091.
Backup nv items:
reading nv-items 8040,8041,8042,8043,8091 through cdmaworkshop


Modify nv items:
item 8040,8041,8042,8043,8091 are all the same.
change them to end part of AN exclude first 10 digits. in this case, it's "56789@mycdma.cn".
you need to change the string into ASCII code (for example,35 36 37 38 39 40 6D 79 63 64 6D 61 2E 63 6E)
Write nv items
the following is content of sample, you can change it, then write back to xoom through CDMAWorkshop.

[NV items]
[Complete items - 5, Items size - 128]

08040 (0x1F68)   -   OK
35 36 37 38 39 40 6D 79 63 64 6D 61 2E 63 6E 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

08041 (0x1F69)   -   OK
35 36 37 38 39 40 6D 79 63 64 6D 61 2E 63 6E 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

08042 (0x1F6A)   -   OK
35 36 37 38 39 40 6D 79 63 64 6D 61 2E 63 6E 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

08043 (0x1F6B)   -   OK
35 36 37 38 39 40 6D 79 63 64 6D 61 2E 63 6E 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

08091 (0x1F9B)   -   OK
35 36 37 38 39 40 6D 79 63 64 6D 61 2E 63 6E 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

2.8 confirm update of AN
in CDMAworkshop, check HDR Username at EVDO tab.


2.10 change IP Behaviour to "Simple IP"
you can do this by CDMAWorkshop or QPST.

2.11 change AAA
Method 1：at CDMA workshop EVDO tab, input AAA(HDR pass), then write into Xoom.
Method 2：write NV item 1192 through CDMAWorkshop, the sample AAA is 123456.

[NV items]
[Complete items - 1]

01192 (0x04A8)   -   OK
06 31 32 33 34 35 36 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

(06: password length, 31 32 33 34 35 36: password ASCII code）

2.12 change SID,NID
run motorola field test util in DIAG mode.
the command is:

am start -a android.intent.action.MAIN -n com.motorola.modemutil/.FieldMenu

then change to the SID,NID of Provider in "Program Menu".
you should take it carefully, just update the fields you really understand.
(if you haven't changed MDN yet, you can change it in passing).
you can run the command in terminal emulator, or by android SDK.

(Tips: to run it on adb shell, first download an app named "adbwireless".
turn on wifi, connect pc and xoom to the same wifi AP.
run adbwireless, turn on adb via wifi.
it shows IP: port, such as 192.168.X.X: 5555.
at windows command prompt, run

adb connect IP: PORT

then run

adb shell

)

2.13 modify android pppd configuration file
this step maybe isn't necessary.
you should need to do this if you still can not get 3g connection after above steps.

to do this step, you need to root xoom first.
please see other post about how to root xoom.

adb remount
adb pull /system/etc/ppp/peers/pppd-ril.options

make a backup of pppd-ril.options file.

change

user NotUsed@nobody.com
password NotUsed

to your ppp dial-up username and password.
in china, it's

user ctnet@mycdma.cn
password vnet.mobi

save the change, run

adb push pppd-ril.options /system/etc/ppp/peers

after these operations, you should see 3g icon on the bottom-right corner.

Hi Hawk, do you need to root before you do this? Thanks.

Also, do we have to change ESN of the xoom in CHina in order to get evdo? Thank you!

Originally Posted by ljwnow

Also, do we have to change ESN of the xoom in CHina in order to get evdo? Thank you!

if you just want to using EvDO, then you should ignore ESN modifing.
in fact, i'm using factory ESN of xoom now.
btw, there is no way being found to change ESN of xoom. you need to change ESN on the provider side to get 1x network working.

for ur first question, i think rooting is not necessary for EvDO hacking.
evenif without rooting, we can still run the offical programming app made by motorola which i mentioned it at the end of the post.


Sent from my Xoom using XDA App

Originally Posted by hawk2k8

if you just want to using EvDO, then you should ignore ESN modifing.
in fact, i'm using factory ESN of xoom now.
btw, there is no way being found to change ESN of xoom. you need to change ESN on the provider side to get 1x network working.

for ur first question, i think rooting is not necessary for EvDO hacking.
evenif without rooting, we can still run the offical programming app made by motorola which i mentioned it at the end of the post.


Sent from my Xoom using XDA App

Thanks for your reply. Would you also post a guide for enabling voice and 1x, please? Thank you.

Originally Posted by ljwnow

Thanks for your reply. Would you also post a guide for enabling voice and 1x, please? Thank you.

I have tried the hidden emergency caller, it told me voice is disabled.

I found some SIP UI built-in, so maybe we can see a integrated VoIP caller on android tablet in the near future.

To enable 1x service, we should change ESN on the provider side to the factory ESN of xoom, then get the changed AKEY from provider, and write it into xoom. It succeeded on Motorola Droid X .

Hawk, great find..

but i step 2.7 Writing NV Item, i always got "Phone Does Not Answer"
i use Motorola USB Network to connect my PC to Xoom.

i use www.whiterabbit.org/android to convert nv asci file..

what is AAA? does it mean AKEY?

update :
Finally i succeed write 4 NV Items..

but in NAM, i still got SID/NID error, here is the log

Write MIN1... Success
Write MIN2... Success
Write Directory number... Success
Write Banner... Success
Write NAM name... Success
Write MCC... Success
Write MNC... Success
Write SID/NID pairs... Failed
Write Primary channels... Success
Write Secondary channels... Success
Write SCM... Success
Write SCI... Skipped
Write Accolc... Success
Write Current NAM... Success
Write True IMSI... Success
Write PRL status... Success
Write System selection... Success
Write Otapa status... Success

QPST always give unspecified error if i open Service Programing, the phone does connect (i can see it in QPST Configuration), i use QPST 2.7 323 version, any advice?

Originally Posted by lesjaw

Hawk, great find..

but i step 2.7 Writing NV Item, i always got "Phone Does Not Answer"
i use Motorola USB Network to connect my PC to Xoom.

i use www.whiterabbit.org/android to convert nv asci file..

what is AAA? does it mean AKEY?

http://www.whiterabbit.org/android/ is great, but some of his items are not necessary for xoom. we should just need item 8040,8041,8042,8043, which is being used to generate AN by radio firmware.

i haven't met "Phone Does Not Answer" message by using CDMAWorkshop to write these nv_items, maybe you can try to write one item at one time to avoid it.

"what is AAA? does it mean AKEY?"
CDMA network has 2 services, the one is high-speed EvDO(data-only) service ,the other is low-speed data-voice sharing 1x service.
AAA is HDR(High Data Rate) password, being used in EvDO service for Authentication,Accounting and Authorization.
AKEY is being used in CDMA-1X network, for voice and 1x service.

Originally Posted by lesjaw

but in NAM, i still got SID/NID error, here is the log



QPST always give unspecified error if i open Service Programing, the phone does connect (i can see it in QPST Configuration), i use QPST 2.7 323 version, any advice?

oh, i forgot it. I changed SID/NID successfully only in motorola programming app. (guide is updated)

and QPST 2.7.323 can not connect to xoom, you should upgrade it.QPST 2.7.355 should work.

3g iusacell/unefon CDMA or telcel GSM what work?

---

Hi hawk2k8:

My xoom is MZ600 Im live in Mexico

Can use your procedure for use my carrier 3g telcel GSM?

o

Maybe buy sim 3g the iusacell o Unefon CDMA?

Please helpme

Regards