+100 ways of anonymity or how to change IMEI on a modem

[Демитрий]

+ 100 ways of anonymity or how to change IMEI on a modem

IMEI is a number, usually unique, for identifying GSM, WCDMA and IDEN phones, as well as some satellite phones. It has 15 digits in decimal representation, where the last digit is the control according to the Moon algorithm, or 17, where two more digits are the version. In other words, this is a personal identifier by which you can be calculated!

Many hackers are interested in USB GPRS modems. The thing is unusually convenient, but it also has an IMEI by which they can calculate ... The article was found on the network. All actions are done at your own peril and risk! I think that by analogy it can be done for other modems of this manufacturer. I’m in a hurry to please - modems can be bought, for example, from Beeline, Megafon or MTS along with a contract, and then throw a SIM card ...


I want to share with you a way to completely restore the ZTE MF626 modem from a half-killed state, with the ability to restore the native, well, or any other IMEI, that's how you please, and other settings closed by the SPC code. Without searching and computing the SPC itself!

In the same way, it is also possible to flashing modems that have not yet been wired, while preserving their settings in case of errors during the flashing, it will all be easy to raise.

To work, you will need two modems, one that is fainting (download status), and live (any ZTE MF626, any operator).

And the required parameter is to sew without a wire, that is, the modem directly into the slot !!!

Still need to get hold of three programs: QPST v2.7 build 301; WinHex v15.0.0 (or any other HEX editor, my choice fell on WinHex, and I advise you) and not necessarily, but preferably RW NV item ZTE MF626, so, to support pants.

I think all this can be found on the Internet without any problems, and if not, write, I will soap them for you. And of course, you will need the firmware itself: MF626 M02 Upgrade Tool and drivers version 1.2050.0.6 with the prescribed lines in the [ZTEcomSerialPort] and [ZTEcomSerialPort.NTamd64] sections in the zteusbdiag.inf file.

Code:

PHP:

% ZTEDevice0016% = ZTEportInstall6k, USBVID_19D2 & PID_0016 & MI_00

% ZTEDevice0016% = ZTEportInstall6k, USBVID_19D2 & PID_0016 & MI_04


Part 1 - If the modem is live:
1) Launch RW NV item ZTE MF626 and make backup.

2) Open the C: drive and see the Channel1.nvm file there, our backup is located in it.

3) Change its extension, for example Channel1.nvm_ like this, this is necessary if the firmware process is not entirely successful

4) Run the MF626 M02 Upgrade Tool and sew.

At the time of backup, another Channel1.nvm is created, we don’t touch it.

In general, steps 1, 2, and 3 can be skipped; they are needed for insurance to facilitate further work. I recommend not to skip them.

When the firmware is completed, distort the modem and install the Telstra software, reboot, and enjoy the Internet!


Part 2 - When the modem (firmware) is dead:
5) This item is needed to restore / change IMEI. We launch QPST v2.7 build 301 -> Service Programming -> Work Offline -> SURF6246-RTR6285-A2, write IMEI, and write it down wherever.

6) Save and call the file, then more and more interesting. Close this software.

7) We go there where we saved the file and open it in QCNView (included in the QPST kit). Go to the Text View tab and find in the text NV item: 550 [NV_UE_IMEI_I]. index 0, in our case it will be 08 1a 32 54 06 12 11 22 02. We are not closing the program yet.

8) To obtain Channel1.nvm, we look at points I.1-3 (at the very beginning of the article) just for this operation we need another modem, one that is live.

Now start WinHex and open C: Channel1.nvm for it, press ALT + G or Position -> Go To Offset, type in New position: 169CC, and get to the first digit of our IMEI and change the HEX value to the one we received in QCNView. It should not go beyond Offset 169D4 !!! Then everything is simple, save and are already starting to rejoice. Yes, I almost forgot WinHex and QCNView can be closed.

9) We start the flasher, we stick in a live modem, nervously smoke ... we wait when backup is done, when it is ready the modem begins to switch to the download state, our task is to prevent this, I will tell about my experience:

When I sewed my modem, I made the volume louder and when the characteristic sound of the disconnected device sounded and the LED on the modem faded, then I quickly pulled it out and stuck a dead modem in it, make a reservation again, it’s better to pull out the modem earlier !!! the later, if it is later, then you will need a third to restore those two. If you need a driver after switching to the download state, then just install it, but only manually, it must get on the same port as before.

The driver will need to select the ZTE HS-USB Diagnostics Interface. Most likely the first firmware will fail, do not get discouraged, and start point 5 again. And if everything goes as it should, then while the firmware is being driven, we go to drive C: there we see two files, the first one: Channel1.nvm_ and Channel1.nvm.

The one that the second Channel1.nvm is deleted, and the first is renamed to the same, that is, in Channel1.nvm. Then we sit and rejoice how the modem is being sewn, the settings are restored, if suddenly a failure occurs and an error pops up, then rename the file again to Channel1.nvm_ and repeat step 5. By the way, when everything works, do not forget to restore the CD_STARTUP_FLAG and FLAG_NO_DOWNLOAD flags on the modem that they kept it from the download-state and nervously ripped it off, they can be taken with the EFS Explorer (QPST) utility on the restored modem.



This article is for informational purposes only and does not call for action!
Source: + 100 to anonymity or how to change IMEI on a modem

 

[Матушкин Андрей Николаевич]