Phone: Htc Droid Incredible: Android 2.2: Baseband Version 2.15.00.07.28
Tools: CDMA Workshop 2.7, QXDM 3.9.19, QPST 2.7, Winhex, Scientific calculator (RealCalc app)
Step 1. Download the HTC diagnostic drivers.
Step 2. Connect the phone to Computer & Dial ##3424# to put the phone in diagnostic mode. It will ask to install the diagnostic Drivers, manually install the drivers from the location where you have downloaded the drivers.
You need to keep the phone in Diagnostic Mode for Programming.
Step 3. Now open QPST Configuration & select the port the phone is on
phone is now showing try to Add port.
Step 4. Open CDMA Work Shop 2.7 Select the port on which phone is connected
Connect the phone & Then Press Read.
Step 5. Now go to security tab and send the spc 000000 Press read button in ESN then Select Universal Ram Method from drop down menu
Press the write button It will ask for 2 options select 2nd option "Scan for ESN Addresses".
Leave the locations as is and click ok. While Scanning u will get all the pEsn Locations.
It will ask you to save the pEsn locations txt file after the scan is finish. Choose to save on the desktop for easy location of the file.
If you don't want to scan these are my ESN Locations for Incredible.
ESN addresses:
0x00FCADB0 0x00FCC67C 0x00FDD590 0x00FED590 0x01144E1C 0x01275C2C 0x015F2CA8 0x017C191C 0x017C1D7C 0x017C8238 0x01882F24 0x01D34C12
(Please do your own scans)
Step 6. Now the memory tab in the "Memory/Eeprom" area, enter the beginning of the address range in the Start box "00FA:0000" and "296124 bytes" in the "Size (bytes)" box. Now click "read" it will ask you to save to a file. Do this for "BOTH REGIONS" you scanned. The second region will likely take a while. The range address are "0108:0000" and "13500000 bytes".
Step 7. Press the (Phone) button on the home screen to get to the dial pad and Enter ##778 call Select view mode and then display. Find the MEID (Hex) and the ESN (Hex) They should Look something like this.
MEID: A1000009C57FQZ
ESN: 8373B5C5
Now pay close attention following the example MEID and ESN I provided above your going to separate every 2 characters and then you are going to flip a few to make it backwards just follow my model and do the same to your numbers.
Original: MEID: A1000009C57FQZ
ESN: 8373B5C5
Separated: MEID: A1 00 00 09 C5 7F QZ
ESN: 83 73 B5 C5
Now Flipped: MEID: QZ 7F C5 09 00 00 A1
ESN: C5 B5 73 83
Step 8. now you have your .bin files open them up in Winhex. Hit CTRL+Alt+X to find the hex values you're looking for your reversed MEID: QZ7FC5090000A1 & ESN: C5B57383. Look at the line your hex value begins on: on the left side of the screen is the line number written in Hex. Put the calculator into Hex mode, then add this value to the value which represents the start of your memory range for that dump. This will be your memory location in hex.
For example, if your range started at 00FA:0000 and you find something you're looking for on line 311B8, you would add FA0000 to 311B8 in your calculator and get FD11B8 add a few 0's and a : and you have the memory location of 00FD:11B8 or 0x00FD11B8
By the calculations above you will get all MEID Locations in QXDM
Now After u have All MEID & pEsn Location u can proceed to the next step.
If you don't want to scan these are my MEID Locations for Incredible.
MEID Addresses: 0x00FAC594 0x00FCD950 0x00FD8350 0x015E7E8C 0x015E7E98 0x017C1DD0 0x018E7A14 0x01D38E2C 0x01D546C1 0x01D3A540
(Please do your own scans)
Step 9. Open QXDM go to communication, Select the port now in Command Line Type "mode offline-d" & press enter then type "spc 000000" & press enter again. Now press F4 and the memory viewer will open 1st start by changing the rows from 8 to 16 then putting the address you got for MEID for Example: 0x00FD11B8 & press Enter now u will get your MEID 14digit in reverse. make it zero & press write. (Note: some meid numbers continue onto other lines so read each location thoroughly and zero them out please.) After you have made MEID zero proceed in same manner for ESN locations & make it zero.
Step 10. Now after MEID & ESN has been made zero you can confirm it by putting the command: "requestnvitemread esn" for esn & "requestnvitemread meid" for meid.
After you get a message that it's zero than u can proceed to write your ESN or MEID which ever you prefer.
Commands are
requestnvitemwrite scm 0x3a
requestnvitemwrite meid 0x(Your MEID)
MEID = actual 14 digit meid (not in reverse)
If u are writing MEID no need to write the ESN.
requestnvitemwrite esn 0x(Your ESN)
esn= actual 8 digit esn (not in reverse)
Restart your phone & hope ur ESN would have changed. Now upload the PRL file of desired operator.
I used this method on an Evo Shift and it worked great. The only instructions I could find that were complete. Thanks.