16 replies to this topic

[Krylon360]

Just thought I would let you guys know. The Unlock/Freeze codes are stored on the bml3 partition. Well, when you Odin Flash, it overwrites that partition.
I tried using the codes I got from my original bml3.bak file. I then tried getting the codes from the bml3 on my phone again and nothing. There wernt any codes on the phone. So needless to say, Looks like I'll have to get a unlock code from T-Mobile.

[Krylon360]

(This will only work if you have your original unlock code)
Okay, so after playing around with some files I've come up with this fix.


follow the directions:

adb shell su dd if=/dev/block/bml3 of=/sdcard/bml3.bak

Mount then copy the file off your phone.

Download HxD (HexEditor)
open the file in HxD
search for SSVN
on the text side, you see SSNV and a bunch of garbled text, then FFFFFFFF
replace the F's with the original unlock code then save it
run the following command:

<path to sgux2.exe> bml3.bak

example: 
cd\
cd GalaxyS
cd Unlock
sgux2.exe bml3.bak

sgux2.exe will now see your unlock code from the bml3.bak file.

I'm working on figuring out a way to push the bml3 block back to the phone now, so keep an eye on this thread.

[Krylon360]

Fixed it!!!!.

in-order to push/pull from the vibrant, you have to modify the playlogos file.
Thanks to Eugene, this has already been done for us, you just need to flash them.
once that's done, you can then run some commands to push the bml3 block back to the phone, and it will read your unlock code.

(I'll test it when I get home. Dont have a AT&T sim here at work.)

I will be working on a "One-Click" fix for this as well. Viral has offered his assistance if needed as well. Thanks man.
What the 1-Click will do is make it so if you don't know your code, it will create one for you

[Krylon360]

PROJECT ON HOLD. PHONE IS COMPLETELY DEAD AND WILL NOT TURN ON!

Warranty Replacement on the way.
New Vibrant will be here Tues/Weds.

[alphadog]

Krylon360, on 01 October 2010 - 02:03 AM, said:

PROJECT ON HOLD. PHONE IS COMPLETELY DEAD AND WILL NOT TURN ON!

Warranty Replacement on the way.
New Vibrant will be here Tues/Weds.

Looking forward to any update. I have a captivate with the FFFF code where the unlock used to be - so even my original unlock code fails. I wonder if flashing back to stock would fix - I doubt it as i just flashed back to stock and did the upgrade to JH7 (the 2.1 maintenance release).

Any idea why many that update to Froyo - which is an Odin flash - don't lose the unlock? Is it using Odin with individual files that causes the issue?

Any details you have - and methods to fix would be great.

[Krylon360]

Got my replacement yesterday. From what I have found, it is also looking at nv_data.bin in the /efs dir. As far as I know, doing a regular ODIN flash doesn't touch this area. I'll be looking at the .bin to see what information is there as well.

[alphadog]

Krylon360, on 06 October 2010 - 09:07 PM, said:

Got my replacement yesterday. From what I have found, it is also looking at nv_data.bin in the /efs dir. As far as I know, doing a regular ODIN flash doesn't touch this area. I'll be looking at the .bin to see what information is there as well.

I would love to find how the /EFS directory gets built - you would think that flashing a phone (somehow) would cause it to read the chip and create whatever files it needed regarding the IMEI. Seems silly that all this flashing and repartitioning can't clear the thing 100%. Maybe it is Samsung's security feature and the flash certain files at the factory through a different tool.

[alphadog]

http://forum.frandro...ic.php?id=26052

It is in french, but apparently it is a way to tell the phone it is completely unlocked. I have not tried it, but the offsets in my nv_data.bin on the Captivate match up exactly to his galaxy S file.

Can anyone read french and review the comments - it seems like it could be the way to go and not even need an unlock code.

[Krylon360]

I translated it. It looks like he's doing the same thing I'm doing. I think I got KANGED though. He started his thread on the 4th.

Either way, next task is reviewing the nv_data.bin

I have a feeling thats where the freeze code is stored. I'll pull the nv_data and bml3 off my new phone to see where they are stored.
Im going to attempt to make a generic code ex. 12345678 for both the unlock and freeze codes.

[alphadog]

I had a hard time with google translation, but it appears he posted it all in English on XDA a while back

http://forum.xda-dev...9&postcount=107

I may give it a go tomorrow. Just need some down time to deal with reflashing everything in the event of a failure - or the possible brick.

If just editing the NV_data.bin works, i guess there is no reason to edit and replace bml3 - seems to easy to just put a code in what part of the NV_data.bin when they went to all the trouble to hide it elsewhere in the file.

Edited by alphadog, 07 October 2010 - 08:01 PM.

[Krylon360]

yep, thats what I was working on. Only I'm taking it a step further. There will be an app for that.

[alphadog]

Krylon360, on 07 October 2010 - 08:51 PM, said:

yep, thats what I was working on. Only I'm taking it a step further. There will be an app for that.

Saw your post on XDA Vibrant Forum - seems with FFFFFFF at the place of the old unlock code, but also at the place where Helroz was working. I would be interested in hearing if you know what the different blocks are for.

Good luck, I am looking forward to being educated.

[TJHart85]

I have an old (non-active) AT&T Sim card that I used to unlock my Vibrant back on JI2 and when I just upgraded to JI6 (from JI5), I put that same SIM card in & it seems to be working fine.

I just threw in an old Cingular SIM Card (obviously also non-active) and it didn't prompt an unlock screen either.  I did back everything up with Titanium backup before I moved to JI6, but as far as I can tell, everything is working well for me.

[Krylon360]

It seems to be pulling the data off of nv_data.bin. I have figured out that the bml3 block is an exact mirror of that .bin file. (this is probably how I bricked my phone.) LOL

I'll be working on this tomorrow. I have a clan match tonight, so wont have much time.

[alphadog]

Krylon360, on 08 October 2010 - 03:38 PM, said:

It seems to be pulling the data off of nv_data.bin. I have figured out that the bml3 block is an exact mirror of that .bin file. (this is probably how I bricked my phone.) LOL

I'll be working on this tomorrow. I have a clan match tonight, so wont have much time.

no new news yet?

[Krylon360]

I've been knee deep in another project so I haven't really had a chance to work on this to much. It'll get completed, just on hold for the time being.

[alphadog]

Krylon360, on 12 October 2010 - 04:28 PM, said:

I've been knee deep in another project *hint hint* so I haven't really had a chance to work on this to much. It'll get completed, just on hold for the time being.

No worries.... just checking in myself. Looking forward to whatever you come up with.