Cdma Flashing Software
Brayan Jacobsen
Action Link Wireless can unlock or flash most cell phones, including both GSM and CDMA devices! Contact us to confirm your phone compatibility. We also now offer unlocking and flashing remotely or by mail service. Fill out this Flashing Request to get started.
Action Link Wireless can now factory unlock all AT&T iPhones so they can be used on other phone carriers. Once unlocked, they will stay unlocked forever and can still be updated with future iOS and firmware upgrades. An unlocked iPhone can be used on T-Mobile or other GSM networks instead of being restricted only to AT&T. Which means you can choose the company with the best coverage and rates for your needs. If you live or travel out of the country, you can even switch to a foreign carrier and avoid paying international roaming charges.
I was recently able to figure out the answer to this question when I successfully flashed a CDMA phone from Sprint to Verizon (an exploit documented in Flashing a Sprint Nexus S 4G to Verizon). As I have not been able to find a compilation of this information elsewhere, I am writing up this document in the hope that it will help others with flashing phones or porting ROMs to different carriers.
Note that this information is based on my research with the Jelly Bean (4.1 & 4.2), ICS (4.0) and Gingerbread (2.3.4) versions of Android and two major U.S. CDMA carriers, Verizon Wireless and Sprint. Hence, it may not be applicable to other phones or carriers; in particular, the section about CDMA chips do not apply to CDMA phones that require a SIM card, such as some Verizon Wireless LTE phones. In such cases, your comments and insights are welcome.
Finally, a disclaimer: I have no formal understanding of any of the intricacies of CDMA technology and therefore cannot guarantee the correctness or accuracy of this information. Use it at your own risk. I cannot be held responsible for any damage or legal consequences resulting from or related to the application of this information.
Every CDMA phone (obviously) has a CDMA chip (radio). This chip is responsible for carrying out voice calls and transferring data over 2G/3G, and in order to do that, it needs to know stuff like what phone number it represents, what towers to connect to, what account name to bill the 3G connection to, etc.. All of this information is stored directly inside the chip (unless you have a Verizon Wireless LTE phone with a SIM card), and not on any file system controlled by the OS; this is why even after a factory reset (which formats the internal flash file system) these settings persist. It is (I believe) not possible to change the information stored on the CDMA chip from the OS itself; instead, carriers provide a special number (e.g., *228 for Verizon Wireless) that, when called, will transfer the information to the chip. This is typically called "programming" the phone by U.S. carriers.
2G/3G data account information: user names and passwords used to connect to data services. Some carriers have stronger (harder to impersonate) authentication systems than others; for instance, Verizon Wireless requires two encrypted passwords and a secret key in the EFS file system on the CDMA chip; Boost Mobile only requires two passwords; while MetroPCS simply accepts the SPC/MSL code (see below) as the password. Note that 2G and 3G are unrelated systems with independent authentication; a phone can have valid 3G credentials and thus connect to 3G while being denied a 2G connection.
Software such as CDMA Workshop, DFS, QXDM/QPST can be used to read / write information stored on a CDMA chip from a computer. Often, however, a 6-digit passcode known as the SPC code or the MSL code is required. This SPC/MSL code, again stored inside the CDMA chip, is either randomly assigned by the carrier (this is the case for Verizon Wireless and Sprint) or deterministically computed based on the MEID (MetroPCS). In the former case, there are a variety of tricks for retrieving the SPC/MSL code from the phone itself,; Google is your friend there. In the latter case, there are sites for computing the code from the MEID. Once it is known, the SPC/MSL code can be changed to any 6-digit number; some phones may even allow you to overwrite the SPC/MSL code without knowing it first.
To figure out what system files in the Android OS contain carrier information, I inspected source code and images of ROMS for the Samsung Galaxy Nexus (Sprint and Verizon Wireless), the Samsung Nexus S 4G (Sprint), the HTC Incredible (Verizon Wireless), and the Motorola Droid 3 (Verizon Wireless). I found three places that store carrier-specific information.
These settings apply to phone calls. If one adopts the Sprint configuration on a Verizon Wireless phone, for example, the phone would ring very briefly on a call, but would be unable to actually make or receive calls. The ro.cdma.homesystem specifies a list of indices into the PRL that represent "home" or non-roaming networks.
The second configuration file is eri.xml, which is compiled into the file /res/xml/eri.xml inside the system package /system/framework/framework-res.apk on an Android system. This file tells the OS what it needs to display about a particular network (as an index into the PRL); for an example, take a look at the stock eri.xml for the Sprint Galaxy Nexus or the CyanogenMod eri.xml for the Verizon Wireless Galaxy Nexus. In particular, this file instructs the OS whether to consider a network (tower) to be roaming (so whether a roaming icon is displayed), and gives the name of the network (tower) to be shown in the UI. It must be stressed that this file has no functional effect; all it changes is how the OS displays information about networks. Since APK packages are just ZIP archives, it is easy to replace the +eri.xml within to change roaming and name settings for networks; note, however, that the file inside the APK is not a plain text XML, but some compiled binary form; you may need to Google for the appropriate binary form pulled from another phone.
The last configuration file is /system/etc/apns-conf.xml. This file contains APN settings for 4G and MMS. See the stock APN settings file for the Sprint Nexus S 4G or the default CyanogenMod APN settings.
An air interface technology that was developed by the U.S. military and commercialized by the U.S. company Qualcomm. CDMA assigns a code to all speech bits, sends a scrambled transmission of the encoded speech over the air and reassembles the speech to its original form at the other end. CDMA supports SMS with a message length of 120 characters. With CDMA, each conversation is digitized and then tagged with a code. The mobile phone receives a signal to locate that particular code and it then deciphers the conversation off the airwaves. It codes each conversation expanding it 128 times, making it easy to decipher at the receiving end.
ESN - Electronic Serial Number, this is used along with the MIN to identify the mobile as a customer with the network, is presented in DEC and HEX formats, and the algorithm is not the same to convert HEX to DEC and vice versa as a normal base conversion. Each time a call is placed, the ESN is automatically transmitted to the base station so the wireless carrier's mobile switching office can check the call's validity.
A 32-bit ESN means there are only 4 billion unique ESN numbers. Combined with other constraints, enough CDMA phones were produced by the end of 2005 that the industry started to run out of unique ESNs.
Note
Please remember that after replacing the old handset with new one, the old phone should not be turned ON again, otherwise that can cause these two phones to be blocked by network provider.
Warning
If the phone's memory contains bad sectors - flashing with *.mbk, *.mfw flash files may cause irreversible changes in the firmware, so the phone will become non-functional!
It's strictly recommended to save a backup copy of the phone's firmware before flashing then the phone can be restored to its previous state. It will be impossible to restore the phone back to the functional state without original backup.
Basically, in this particular context:
flashing - installing something other than what was there before
ROM - Read Only Memory, originally, but now just means a different version of the OS (custom, stock, original, etc.)
boot - start, turn on
reboot- restart, turn off, then on again
It allows you to flash or install the stock firmware (ROM) on the feature phone powered by Qualcomm Chipset. All you need to have the correct firmware of your FeaturePhone > Install the Supported USB Driver > Launch the Tool > Go to Settings > Under CDMA Locate the Write Code and EFS Code > Click on the OK button > Click on Start to begin the Flash.
It comes in support of the CDMA devices powered by Qualcomm Chipset. Once you have installed the supported USB Driver on the Computer, CDMA Download Tool can easily detect the connected device on the computer and get ready to flash or install the firmware (ROM) on the CDMA device.
It supports flashing or installing the .bin based stock firmware (ROM) on the CDMA devices powered by Qualcomm Chipset. You can find the .bin file in the Stock Firmware of your CDMA device released by the device manufacturer.
CDMA Download Tool is compatible with all version of Windows OS, including Windows XP to Windows 11 (x32 or x64 bit). If in case you were looking for the latest version of the CDMA Download Tool, then use the following links to get it on your computer:
[*] Alternative Tool: We have shared a bunch of tools that also allow you to flash or install stock firmware on Qualcomm Devices. You can check them all from our Qualcomm Tool section.
Devices:
The best make of evdo or cdma device seems to be the ZTE modems, ZTE put in the mobile and data network in Ethiopia and from personal experince I have seen much faster speeds and reliability when using ZTE devices. Things to watch is to make sure the modem has a esn number on the back usually written in light black writing on a black background. ETC use this number to register you device for EVDO apparently. Also the ZTE devices have Linux drivers and have a mini flash card port as well. At time of writing they cost around 1800 Birr.