[hanhao]

use these software:

UniCDMA
QXDM
blackberry DM.

method:
1)change RAM
2)nv_write esn

OK

[Sith_Apprentice]

you might want to be a bit more descriptive in your post. the ESN is hard coded into the device.

[Dawg]

I think hes trying to tell people how to change the esn on there device.

[Sith_Apprentice]

well without another ESN that would be useless and not certain it would work on BBs. Worth a shot a guess.

[Dawg]

yeah this is from CDMA tools i believe.

[floz23]

Remember people, changing your ESN is very illegal.

[Sith_Apprentice]

if the ESN is linked to the PIN and you change the ESN and cannot change the PIN your service wont work anyway

[hanhao]

in china,we use a UIM card (like SIM card ) for network authentication.
thus,if we can't change 8830's ESN, then the box won't work.

so,change the box's ESN to the same of UIM will bring it back to work!

[hotboyarchie]

When you said change ram thats the only thing i lost with can you aim me or y im me. I have been doing my research and have got everything to work but when i us qxdm and enter the write command it says unable to build buffer?

[hotboyarchie]

Originally Posted by hanhao

use these software:

UniCDMA
QXDM
blackberry DM.

method:
1)change RAM
2)nv_write esn

OK

Hey i have been going at this phone for about 2 days. I have got the prl's loaded to the phone. So im on metro pcs's network. But heres the problem i have been trying to change the ens to one from a old broken phones one i have. I have tryed using QXDM and keep getting the error unable to build buffer. When i try to run the nv ens write command. I have also tryed using CDMA Workshop, Universal CDMA Programmer, and QPST. I know i can just take this phone to metro and all they will have to do is add the ens in there system for $30. But i wanted to learn on my own. And now i need some help

[Dawg]

Originally Posted by hotboyarchie

Hey i have been going at this phone for about 2 days. I have got the prl's loaded to the phone. So im on metro pcs's network. But heres the problem i have been trying to change the ens to one from a old broken phones one i have. I have tryed using QXDM and keep getting the error unable to build buffer. When i try to run the nv ens write command. I have also tryed using CDMA Workshop, Universal CDMA Programmer, and QPST. I know i can just take this phone to metro and all they will have to do is add the ens in there system for $30. But i wanted to learn on my own. And now i need some help

its not going to work just give up now and get the rest

[hanhao]

1)dump your rom using unicdma
2)find your old esn from the dumped_rom, write down the address
3)change all the address to 0x00,thus nv_read esn -> 00000000
4)then use command: nv_write esn ,every thing will be OK now.

enjoy!

[mattguyver]

Originally Posted by hanhao

1)dump your rom using unicdma
2)find your old esn from the dumped_rom, write down the address
3)change all the address to 0x00,thus nv_read esn -> 00000000
4)then use command: nv_write esn ,every thing will be OK now.

enjoy!

Step 5, use your new brick as a paperweight.

[xtremelydeep]

Step 5 is more comedy relief than informative.

from what I understand; what Hanhao is trying to describe works on one out of ten Blackberry's.

lets say you dumped the rom and found your esn starting @ the hex address 0x100586F4.

For some reason ESN are stored backward in rom, so if your esn is 1234 in rom it will be 4321.

So you have the exact address of the start of your esn (which is the last two digit hex number). A hex esn would be four two digit addresses, because a hex esn is 8 hex digits. So your esn start and runs thru addresses 0x100586F4, 0x100586F5, 0x100586F6, 0x100586F7.

The idea is to "poke" these addresses to 0x00 then send a change esn command.

so if your ESN was A1B2C3D4 and you "peeked" that address in QXDM;

peek byte 1005:86F4 4
(that four at the end is important and necessary, it tells qxdm that you only want four bytes after that address... you could have said 16 or 32 or whatever and it would have streamed on)
you would get:
D4 C3 B2 A1
and of course you'd do that to be SURE you have the right address.

So down to brass tacks:
poke byte 1005:86F4 0x00
poke byte 1005:86F5 0x00
poke byte 1005:86F6 0x00
poke byte 1005:86F7 0x00
nv_write esn {0x00000000}

Now at that last command you will prolly realize you're going nowhere...
Repeat the last ESN check command we did before;

peek byte 1005:86F4 4

Now I ASSUME it should now tell you your esn is 00 00 00 00
But if your experience was like mine it will reflect your original esn... nothing changed even thought it was telling you "successful poke" all that time

If it works for you I'd sure like to know it.

step 5 is actually continue trying to find a way... nothing to do with a paper weight.

[Dawg]

exactly