Quantcast
Channel: xda-developers - Android Software and Hacking General [Developers Only]
Viewing all articles
Browse latest Browse all 3614
↧

Possible Samsung Unlock method through RIL_OEM_HOOK_RAW?

April 10, 2016, 7:53 am
$
0
0
Hello,

I was looking into CSC.apk today when this caught my eye

CscModemSettingService.java
Notice updateLockInfo and addLockInfo

Code:
/*
 * Decompiled with CFR 0_110.
 *
 * Could not load the following classes:
 *  android.app.Service
 *  android.content.Context
 *  android.content.Intent
 *  android.content.SharedPreferences
 *  android.content.SharedPreferences$Editor
 *  android.os.Bundle
 *  android.os.Handler
 *  android.os.IBinder
 *  android.os.Message
 *  android.os.SystemProperties
 *  android.util.Log
 *  com.samsung.android.sec_platform_library.FactoryPhone
 *  com.samsung.android.sec_platform_library.PacketBuilder
 *  java.io.File
 *  java.lang.Byte
 *  java.lang.Integer
 *  java.lang.Object
 *  java.lang.Runnable
 *  java.lang.String
 *  java.lang.StringBuffer
 *  java.lang.Thread
 *  java.util.ArrayList
 *  org.w3c.dom.Node
 *  org.w3c.dom.NodeList
 */
package com.samsung.sec.android.application.csc;

import android.app.Service;
import android.content.Context;
import android.content.Intent;
import android.content.SharedPreferences;
import android.os.Bundle;
import android.os.Handler;
import android.os.IBinder;
import android.os.Message;
import android.os.SystemProperties;
import android.util.Log;
import com.samsung.android.sec_platform_library.FactoryPhone;
import com.samsung.android.sec_platform_library.PacketBuilder;
import com.samsung.sec.android.application.csc.CscParser;
import java.io.File;
import java.util.ArrayList;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;

public class CscModemSettingService
extends Service {
    private static final boolean isMarvell = "mrvl".equalsIgnoreCase(SystemProperties.get((String)"ro.board.platform", (String)"Unknown").trim());
    private String CPLockCode = "";
    private String DEFAULT_CSC_FILE = CscParser.getCustomerPath();
    private String NSPLockCode = "";
    private String NetLockCode = "";
    private String OTHERS_CSC_FILE = CscParser.getOthersPath();
    private String SPLockCode = "";
    private int amrVoiceCodec = -1;
    private int generalLockInfo = 0;
    private int gprsAttachMode = 1;
    ArrayList<Byte> mByteArray = new ArrayList();
    private Handler mHandler;
    private Intent mIntent = null;
    private int mItemCount = 0;
    private FactoryPhone mPhone = null;
    private int networkMode = 0;
    private int ssms = -1;
    private String strNetworkMode = "auto";
    private String strSalesCode = "";
    private int unlockCnt = 3;

    public CscModemSettingService() {
        this.mHandler = new Handler(){

            /*
            * Enabled aggressive block sorting
            * Lifted jumps to return sites
            */
            public void handleMessage(Message message) {
                int n = message.getData().getInt("error");
                switch (message.what) {
                    default: {
                        return;
                    }
                    case 2000: {
                        Log.i((String)"CscModemSettingService", (String)"SEND_PRECONFIG_DONE response incoming!!");
                        if (n == 0) return;
                        Log.i((String)"CscModemSettingService", (String)"AsyncResult Exception Occur!!!");
                        return;
                    }
                    case 2001: {
                        Log.i((String)"CscModemSettingService", (String)"SEND_MODEM_DONE response incoming!!");
                        if (n == 0) return;
                        Log.i((String)"CscModemSettingService", (String)"AsyncResult Exception Occur!!!");
                        return;
                    }
                    case 2002:
                }
                Log.i((String)"CscModemSettingService", (String)"SEND_RESET_DONE response incoming!!");
                if (n != 0 && !isMarvell) {
                    Log.i((String)"CscModemSettingService", (String)"AsyncResult Exception Occur!!!");
                    return;
                }
                SharedPreferences.Editor editor = CscModemSettingService.this.getSharedPreferences("csc.preferences_name", 0).edit();
                editor.putBoolean("csc.key.csc_modem_setting_done", true);
                editor.commit();
            }
        };
    }

    private void compareLockAndModemInfo() {
        this.readModemInfo();
        this.readLockInfo();
        this.mItemCount = 0;
        this.mByteArray = new ArrayList();
        this.addModemInfoToBuffer();
        this.addLockInfoToBuffer();
        Log.i((String)"CscModemSettingService", (String)("compareLockAndModemInfo() : mByteArray = " + this.mByteArray.size()));
        this.sendByteBuffer(7, 1);
    }

    /*
    * Enabled aggressive block sorting
    */
    private void readLockInfo() {
        CscParser cscParser = new CscParser(this.DEFAULT_CSC_FILE);
        int n = 5;
        this.NetLockCode = "";
        this.SPLockCode = "";
        this.NSPLockCode = "";
        this.CPLockCode = "";
        String string = cscParser.get("Settings.Main.Security.UnlockCnt");
        this.unlockCnt = string == null ? 3 : new Integer(string);
        NodeList nodeList = cscParser.searchList(cscParser.search("Settings.Main.Security."), "NetworkLock");
        if (nodeList != null && nodeList.getLength() > 0) {
            this.generalLockInfo = 1 | this.generalLockInfo;
            for (int i = 0; i < nodeList.getLength(); ++i) {
                StringBuffer stringBuffer = new StringBuffer(cscParser.getValue(nodeList.item(i)));
                if (stringBuffer.toString().length() == 5) {
                    n = 5;
                    stringBuffer.append("#");
                } else {
                    n = 6;
                }
                Log.i((String)"CscModemSettingService", (String)("NetworkLock > code (" + i + ") : " + stringBuffer.toString()));
                this.NetLockCode = this.NetLockCode + stringBuffer.toString();
            }
        }
        Log.i((String)"CscModemSettingService", (String)("NetworkLock > all code : " + this.NetLockCode));
        NodeList nodeList2 = cscParser.searchList(cscParser.search("Settings.Main.Security."), "SubsetLock");
        if (nodeList2 != null && nodeList2.getLength() > 0) {
            this.generalLockInfo = 2 | this.generalLockInfo;
            for (int i = 0; i < nodeList2.getLength(); ++i) {
                StringBuffer stringBuffer = new StringBuffer(cscParser.getValue(nodeList2.item(i)));
                if (stringBuffer.toString().length() == 2) {
                    stringBuffer.append("#");
                }
                Log.i((String)"CscModemSettingService", (String)("SubsetLock > code (" + i + ") : " + stringBuffer.toString()));
                this.NSPLockCode = this.NSPLockCode + Integer.toString((int)n) + stringBuffer.toString();
            }
        }
        Log.i((String)"CscModemSettingService", (String)("SubsetLock > all code : " + this.NSPLockCode));
        NodeList nodeList3 = cscParser.searchList(cscParser.search("Settings.Main.Security."), "SPLock");
        if (nodeList3 != null && nodeList3.getLength() > 0) {
            this.generalLockInfo = 8 | this.generalLockInfo;
            for (int i = 0; i < nodeList3.getLength(); ++i) {
                String string2 = cscParser.getValue(nodeList3.item(i));
                Log.i((String)"CscModemSettingService", (String)("SPLock > code (" + i + ") : " + string2));
                this.SPLockCode = this.SPLockCode + string2;
            }
        }
        Log.i((String)"CscModemSettingService", (String)("SPLock > all code : " + this.SPLockCode));
        NodeList nodeList4 = cscParser.searchList(cscParser.search("Settings.Main.Security."), "CPLock");
        if (nodeList4 != null && nodeList4.getLength() > 0) {
            this.generalLockInfo = 16 | this.generalLockInfo;
            for (int i = 0; i < nodeList4.getLength(); ++i) {
                String string3 = cscParser.getValue(nodeList4.item(i));
                Log.i((String)"CscModemSettingService", (String)("CPLock > code (" + i + ") : " + string3));
                this.CPLockCode = this.CPLockCode + string3;
            }
        }
        Log.i((String)"CscModemSettingService", (String)("CPLock > all code : " + this.CPLockCode));
    }

    /*
    * Enabled aggressive block sorting
    */
    private void readModemInfo() {
        CscParser cscParser = new CscParser(this.DEFAULT_CSC_FILE);
        this.strNetworkMode = new CscParser(this.OTHERS_CSC_FILE).get("Settings.Main.Network.NetworkMode");
        if (this.strNetworkMode == null) {
            String string = SystemProperties.get((String)"ro.csc.sales_code");
            this.networkMode = "SKT".equals((Object)string) || "KTT".equals((Object)string) || "LGT".equals((Object)string) ? 0 : 1;
        } else if (this.strNetworkMode.equalsIgnoreCase("auto")) {
            this.networkMode = 1;
        } else if (this.strNetworkMode.equalsIgnoreCase("UMTS")) {
            this.networkMode = 2;
        } else if (this.strNetworkMode.equalsIgnoreCase("GSM")) {
            this.networkMode = 3;
        } else if (this.strNetworkMode.equalsIgnoreCase("900")) {
            this.networkMode = 4;
        } else if (this.strNetworkMode.equalsIgnoreCase("1800")) {
            this.networkMode = 5;
        } else if (this.strNetworkMode.equalsIgnoreCase("1900")) {
            this.networkMode = 6;
        }
        if (cscParser.get("Settings.Main.Network.AutoAttach") == null) {
            this.gprsAttachMode = 1;
        } else if (cscParser.get("Settings.Main.Network.AutoAttach").equalsIgnoreCase("on")) {
            this.gprsAttachMode = 1;
        } else if (cscParser.get("Settings.Main.Network.AutoAttach").equalsIgnoreCase("off")) {
            this.gprsAttachMode = 0;
        }
        if (cscParser.get("Settings.Messages.SMS.SSMS") == null) {
            this.ssms = 0;
        } else if (cscParser.get("Settings.Messages.SMS.SSMS").equalsIgnoreCase("on")) {
            this.ssms = 1;
        } else if (cscParser.get("Settings.Messages.SMS.SSMS").equalsIgnoreCase("off")) {
            this.ssms = 0;
        }
        if (cscParser.get("Settings.Main.Sound.AMRVoiceCodec") == null) {
            this.amrVoiceCodec = -1;
            return;
        } else {
            if (cscParser.get("Settings.Main.Sound.AMRVoiceCodec").equalsIgnoreCase("enable") || cscParser.get("Settings.Main.Sound.AMRVoiceCodec").equalsIgnoreCase("on")) {
                this.amrVoiceCodec = 1;
                return;
            }
            if (!cscParser.get("Settings.Main.Sound.AMRVoiceCodec").equalsIgnoreCase("disable") && !cscParser.get("Settings.Main.Sound.AMRVoiceCodec").equalsIgnoreCase("off")) return;
            {
                this.amrVoiceCodec = 0;
                return;
            }
        }
    }

    private void readSalesCode() {
        this.strSalesCode = new CscParser(this.DEFAULT_CSC_FILE).get("GeneralInfo.SalesCode");
        Log.i((String)"CscModemSettingService", (String)("csc modem strSalesCode = " + this.strSalesCode));
    }

    private void updateLockInfo() {
        String string;
        String string2 = CscParser.getSalesCode();
        if (!string2.equals((Object)"null") && new File(string = "/system/csc/" + string2 + this.DEFAULT_CSC_FILE).exists()) {
            this.DEFAULT_CSC_FILE = string;
        }
        this.readLockInfo();
        this.mItemCount = 0;
        this.mByteArray = new ArrayList();
        this.addLockInfoToBuffer();
        Log.i((String)"CscModemSettingService", (String)("updateLockInfo() : mByteArray Size = " + this.mByteArray.size()));
        this.sendByteBuffer(8, 0);
    }

    private void updateModemInfo() {
        this.readSalesCode();
        this.sendSalesCode();
        this.readModemInfo();
        this.mItemCount = 0;
        this.mByteArray = new ArrayList();
        this.addModemInfoToBuffer();
        Log.i((String)"CscModemSettingService", (String)("updateModemInfo() : mByteArray Size = " + this.mByteArray.size()));
        this.sendByteBuffer(7, 0);
        this.sendResetMsg();
    }

    public void addLockInfoToBuffer() {
        Log.i((String)"CscModemSettingService", (String)"add Lock Info");
        this.mByteArray.add((Object)new Byte(-127));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(6));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(1));
        this.mByteArray.add((Object)new Byte(1));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(1));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte((byte)(255 & this.generalLockInfo)));
        this.mItemCount = 1 + this.mItemCount;
        if ((1 & this.generalLockInfo) > 0) {
            int n = this.NetLockCode.length();
            int n2 = n + 15;
            this.mByteArray.add((Object)new Byte(-126));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n2 & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n2 << 8)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(2));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(255 & this.unlockCnt)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n << 8)));
            new byte[this.NetLockCode.length()];
            byte[] arrby = this.NetLockCode.getBytes();
            for (int i = 0; i < arrby.length; ++i) {
                this.mByteArray.add((Object)new Byte(arrby[i]));
            }
            this.mItemCount = 1 + this.mItemCount;
        }
        if ((2 & this.generalLockInfo) > 0) {
            int n = this.NSPLockCode.length();
            int n3 = n + 15;
            this.mByteArray.add((Object)new Byte(-125));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n3 & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n3 << 8)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(2));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(255 & this.unlockCnt)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n << 8)));
            new byte[this.NSPLockCode.length()];
            byte[] arrby = this.NSPLockCode.getBytes();
            for (int i = 0; i < arrby.length; ++i) {
                this.mByteArray.add((Object)new Byte(arrby[i]));
            }
            this.mItemCount = 1 + this.mItemCount;
        }
        if ((8 & this.generalLockInfo) > 0) {
            int n = this.SPLockCode.length();
            int n4 = n + 15;
            this.mByteArray.add((Object)new Byte(-124));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n4 & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n4 << 8)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(2));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(255 & this.unlockCnt)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n << 8)));
            new byte[this.SPLockCode.length()];
            byte[] arrby = this.SPLockCode.getBytes();
            for (int i = 0; i < arrby.length; ++i) {
                this.mByteArray.add((Object)new Byte(arrby[i]));
            }
            this.mItemCount = 1 + this.mItemCount;
        }
        if ((16 & this.generalLockInfo) > 0) {
            int n = this.CPLockCode.length();
            int n5 = n + 15;
            this.mByteArray.add((Object)new Byte(-123));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n5 & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n5 << 8)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(2));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(255 & this.unlockCnt)));
            this.mByteArray.add((Object)new Byte(3));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(n & 255)));
            this.mByteArray.add((Object)new Byte((byte)(n << 8)));
            new byte[this.CPLockCode.length()];
            byte[] arrby = this.CPLockCode.getBytes();
            for (int i = 0; i < arrby.length; ++i) {
                this.mByteArray.add((Object)new Byte(arrby[i]));
            }
            this.mItemCount = 1 + this.mItemCount;
        }
    }

    public void addModemInfoToBuffer() {
        Log.i((String)"CscModemSettingService", (String)"add Modem Info");
        if (this.networkMode > 0) {
            this.mByteArray.add((Object)new Byte(-121));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(255 & this.networkMode)));
            this.mItemCount = 1 + this.mItemCount;
        }
        this.mByteArray.add((Object)new Byte(-119));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(1));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte((byte)(255 & this.gprsAttachMode)));
        this.mItemCount = 1 + this.mItemCount;
        if (this.amrVoiceCodec >= 0) {
            this.mByteArray.add((Object)new Byte(-117));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte(1));
            this.mByteArray.add((Object)new Byte(0));
            this.mByteArray.add((Object)new Byte((byte)(255 & this.amrVoiceCodec)));
            this.mItemCount = 1 + this.mItemCount;
        }
        this.mByteArray.add((Object)new Byte(-115));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(11));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(2));
        this.mByteArray.add((Object)new Byte(1));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(1));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte((byte)(255 & this.ssms)));
        this.mByteArray.add((Object)new Byte(2));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(1));
        this.mByteArray.add((Object)new Byte(0));
        this.mByteArray.add((Object)new Byte(0));
        this.mItemCount = 1 + this.mItemCount;
    }

    public IBinder onBind(Intent intent) {
        return null;
    }

    public void onCreate() {
        this.mPhone = new FactoryPhone((Context)this);
    }

    public void onDestroy() {
        super.onDestroy();
        this.mPhone.disconnectFromRilService();
    }

    public void onStart(Intent intent, int n) {
        Log.i((String)"CscModemSettingService", (String)"onStart");
        this.mIntent = intent;
        Thread thread = new Thread(new Runnable(){

            public void run() {
                if (CscModemSettingService.this.mIntent != null && CscModemSettingService.this.mIntent.hasExtra("MODE")) {
                    String string = CscModemSettingService.this.mIntent.getStringExtra("MODE");
                    if ("SET_LOCK_INFO".equals((Object)string)) {
                        Log.i((String)"CscModemSettingService", (String)"SET_LOCK_INFO for modem values. (PHASE 1 writing)");
                        CscModemSettingService.this.updateLockInfo();
                    }
                    if ("SET_MODEM_INFO".equals((Object)string)) {
                        Log.i((String)"CscModemSettingService", (String)"SET_MODEM_INFO for modem values. (PHASE 2 writing)");
                        CscModemSettingService.this.updateModemInfo();
                    }
                    if ("COMPARE_VERIFY_MODEM".equals((Object)string)) {
                        Log.i((String)"CscModemSettingService", (String)"COMPARE_VERIFY for modem values. ");
                        CscModemSettingService.this.compareLockAndModemInfo();
                    }
                    return;
                }
                Log.i((String)"CscModemSettingService", (String)"NO EXTRA");
            }
        });
        thread.setPriority(10);
        thread.start();
    }

    public void sendByteBuffer(int n, int n2) {
        int n3 = this.mByteArray.size();
        byte[] arrby = new byte[n3];
        for (int i = 0; i < n3; ++i) {
            arrby[i] = ((Byte)this.mByteArray.get(i)).byteValue();
        }
        Log.i((String)"CscModemSettingService", (String)"sendByteBuffer");
        PacketBuilder packetBuilder = new PacketBuilder(6, (byte)n);
        if (n == 7) {
            packetBuilder.addData((byte)n2);
        }
        packetBuilder.addData((byte)this.mItemCount);
        packetBuilder.addData(arrby, 0, n3);
        this.mPhone.invokeOemRilRequestRaw(packetBuilder.getPacket(), this.mHandler.obtainMessage(2001));
    }

    public void sendResetMsg() {
        Log.i((String)"CscModemSettingService", (String)"sendResetMsg");
        PacketBuilder packetBuilder = new PacketBuilder(6, 5);
        packetBuilder.addData(1);
        if (this.mPhone != null) {
            this.mPhone.invokeOemRilRequestRaw(packetBuilder.getPacket(), this.mHandler.obtainMessage(2002));
            return;
        }
        Log.e((String)"CscModemSettingService", (String)"sendResetMsg fail");
    }

    public void sendSalesCode() {
        Log.i((String)"CscModemSettingService", (String)"sendSalesCode");
        if (this.strSalesCode == null) {
            return;
        }
        PacketBuilder packetBuilder = new PacketBuilder(6, 1);
        packetBuilder.addData(0);
        packetBuilder.addData(0);
        packetBuilder.addData(this.strSalesCode.getBytes(), 0, this.strSalesCode.getBytes().length);
        this.mPhone.invokeOemRilRequestRaw(packetBuilder.getPacket(), this.mHandler.obtainMessage(2000));
    }

}


It appears to read the lock codes from the /system/CSC and then update them in the modem through RIL function invokeOemRilRequestRaw (this is also the same api that samsung servicemode app uses). This is on an sgh m919.
Perhaps this could be copied, but we could instead send 00000000 as the new NetLock code?
Obviously this would require root and require the app to be running as a system app since we are calling a protected RIL function (unless we use the Samsung @multiclient api, that requires no privileges and is implemented in stock). But it would be simple to make such an app if this method works. I also discovered that unlockCnt is the number of tries you get for the network unlock code before it is locked out, not that it matters if we can just change the code to whatever we want.


Edit: looks like it is not setting the network lock key as I originally thought, but instead setting a list of allowed MCCMNC that are read from the CSC.
So if the phone was locked to MCCMNCs (making these up)
310020
48262
137373
Payload would be
31002048262#137373

I think these are being written to NVRAM through the raw ril requests
There might be another value that controls whether the region/network lock is on at all. Maybe if we just set it to an empty string, it will turn off?

I know that the app RegionLockAway works somewhat like this. It makes changes to the CSC file and then invokes CSC.apk to send the changes to the modem.
↧
Search
Viewing all articles
Browse latest Browse all 3614

Trending Articles

RAMAYAMPET Mandal Sarpanch | Upa-Sarpanch | Ward member Mobile Numbers Medak...

May 24, 2017, 2:00 am

लड़कियां सेक्स के दौरान क्यों करती है उह! आह!लड़कियां सेक्स के दौरान क्यों करती...

May 19, 2016, 1:54 am

Neem Baba Extra Questions Answer Class 6 English Poorvi

February 1, 2025, 5:19 am

Throw Back: 4×4 — Sikilitele (Ft Castro) Prod by JQ

March 5, 2015, 8:24 am

Rajasthan Board 10th Result 2016 Roll No wise & Name Wise

August 20, 2016, 5:13 pm

Lowe faces four theft charges

November 14, 2017, 6:52 pm

Practice Sheet of Right form of verbs for HSC Students

September 22, 2019, 11:40 pm

Mafia, Murder & Mayhem In The Motor City: Detroit Mob Hit Timeline (1937-2007)

December 7, 2016, 3:57 pm

The 10 Tennessee Cities With The Largest Black Population For 2021

December 21, 2020, 10:12 am

Materials Around Us Class 6 Worksheet Science Chapter 6

October 3, 2024, 5:20 am

デスクトップ ヒープの枯渇

January 18, 2018, 8:31 pm

Best Suvichar in Hindi |बेस्ट सुविचार |शुभ विचार हिंदी में

March 7, 2020, 11:19 pm

Kanulanu Thaake Lyrics and translation | Manam (2014)

May 9, 2014, 5:45 am

Korean Sex Porn Videos: XXX Videos & Free Porn Movies

May 30, 2025, 9:29 pm

Teen Shot In Miami Drive-By Dies From Injuries

August 8, 2011, 1:16 pm

Download: IQ Muzatasha feat Shy D & Pmj – Ulesi NiFertilizer Yamavuto

March 22, 2018, 7:23 pm

Mahakal Attitude Status

February 29, 2020, 9:52 am

Property developer set up cannabis factory to help pay off debts...

August 3, 2015, 2:29 am

♡

July 11, 2015, 6:15 am

KB: How to troubleshoot issues when adding a Hyper-V host in System Center...

August 14, 2012, 10:05 am
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>