THANK YOU VERY MUCH kmani.k78 & aalyatim AND ECS87, AND THE REST OF THE PEOPLE THAT PUT SO MUCH EFFORT INTO THIS!!!
I have experience doing sim unlocking (I found the sim unlock method for the LG Optimus 3D).
I bought one of this phones to try to unlock it.
What I have found so far:
-The uicc unlock is preformed by Sprint OTA (over the air) by sending a network message to the phone to init the unlocking function.
-This message can be sent by generating a fake message and using a software DFS CDMA to comunicate to the device modem and generate the secuence.
-This was done to the Sprint Galaxy S4 but now Samsung implemented a signed encrypted package for the S5.
-By default, domestic networks (Tmobile and ATT) are locked even though sprint unlocks the uicc
-This can be overriden easily once we unlock the uicc
What I need to continue my search:
-a EFS and NVRAM Backup of a phone that had the uicc unlocked
-a App Log for the uicc unlocking state (a phone that is eligible for unlocking by sprint and activate the application log to monitor the unlocking process)
INSTRUCTIONS for the App Log
Because we only have one chance and I don't want to let it go. Please please if you are eligible for a Sprint unlock contact me and we will set up a live meeting so we can setup your phone before hand (root, increase log buffer sizes, etc) and preform together the unlock process. Also because I have not seen the unlock process I don't know if the device will reboot or what happens and I don't want the logs to be overridden or deleted in the process.
INSTRUCTIONS for the EFS and NVRAM dump
If you already unlocked your phone and have an active sim slot, because you went through the process of calling Sprint and they agreed to unlock your phone.
Download the following tool:
Select the option Backup partition for LTE device.
Any help would benefit the entire comunity.