CDMA Workshop | MEID/ESN/IMEI repair | SPC unlock..
Current version: 3.9.0
Date: 09-Dec-2012
CDMA Workshop is a professional,
universal,
all-in-on, amazingly powerful service software, developed to work with any
CDMA and GSM phones,
smart phones, tablets, fixed terminals, data cards/modems based on any
Qualcomm and compatible chipsets. It is the necessary tool for easy
and fast programming or re-programming (full flash) CDMA devices
to any network, unlocking, repair ESN, MEID, IMEI.. security
codes, such as: user lock, SPC, MSL, FSC, OTKSL, Minlock, SIM-lock,
etc.. authentication security codes, such as: A-key, SSD_A, SSD_B
keys.. Bluetooth, WiFi MAC addresses.. and many many other
things. CDMA Workshop is safe in use, does not require administrative
rights on your computer, it combines all major functions and operations which
are necessary for full-functional work with CDMA devices and&it is a
<<must have>>
software for every serious technician, cellular/repair shops and dealers.
Strongly recommended.
Supported Windows: Windows 2000,
XP, Server, Vista, Windows 7, Windows 8, 8.1 (x32
Supported Interfaces: COM (serial), USB, USB-to-COM
converters, any kind of Uniboxes
No credits or logs, no monthly/yearly fee. Fully unlimited
solution. Pay once - use lifetime.
&Main& tab& -&
In order to program phones to a necessary
network you need write network settings, such as: MCC, MNC, SID-NID
pairs, Primary/Secondary channels, etc. You can write these parameters
on this tab, as well as read existing settings from any worked already
programmed phone and create your own collection of network settings for
each network you necessary. You can read/write and change any other
settings related with Qualcomm mobile devices, such as: EVDO, Data,
R-UIM, AMPS, GSM, Broadcast SMS, SMS-CB, SMS, Multimedia, gpsOne,
Timers, IPv6, RmNet, IWLAN, eHRPD.
This professionally made flashing engine has been specially
optimized for users who are programming a lot of devices every day and
want to get maximally speedy, convenient, and functional
solution. It does not have any restrictions and it is more powerful than
even native Qualcomm software. CDMA Workshop makes your life easy and
work effective.
Furthermore, CDMA Workshop is able to calculate &not programmed& True
IMSI value (only for CDMA Workshop users).
If True IMSI is not used in your network as one of the authentication
parameter, then you need to write a special value of True IMSI, called
&not programmed&. This value is based on current ESN (pESN), they must
be matching each other. Thus, if you changed ESN or MEID, then
do not forget to re-calculate &not programmed& IMSI value to
correctly program your device.
&Memory& tab& -&
Read/Write/Scan& -& at first,
you can scan memory by using the &Scan Memory& function, in order to get
a memory map and find readable addresses of memory. After that, you can
use these found readable addresses in Read/Write functions and in
&Universal RAM& methods (&ESN&, &MEID, &SPC&, &Cave& sections.. see
& - &EFS_RAW& - method can read
EFS in low-level RAW format, sector by sector, but not as a regular list
of files and directories. Mostly, this function is very useful to
extract, from the resulting dump, security codes, authentication keys,
EVDO logins/passwords, etc, while regular access to system files in EFS
is locked by manufacturer. You can use very useful built-in &Keyboard
codes searcher& tool for such purposes. Many brands and models allow
reading EFS in low-level RAW format, such as: wide range of
LG, Samsung, Kyocera, Motorola, Palm models, Huawei,
Sierra, C-motech, Franklin modems, MDM9600 (HTC),
etc. All &EFS_RAW& methods in CDMA Workshop support and
automatically detect both standard and Alternate ways to access
to EFS_RAW. As a result, you will additionally be able to operate with
more devices where &Alternate& way is used, for example:
Huawei 3G Mobile WiFi (MiFi) E585, E5832, E5830, E583C, etc.
& - &RAM_3A& - the access type to
a memory which is only available in Download Mode and in devices with
download protocol version 6 or greater. This method is mostly supported
by newer devices, just for example: Novatel
modems/routers PC770, C777 (Merlin), U720, U727, U760, MiFi2200, etc..
Huawei M635, M735.. Kyocera S3015 Brio.. GSM phones Sony XPeria X2, LG
Optimus Elite, etc). You can use this method and then extract
SPC, EVDO logins, passwords, etc from the resulting dump using &Keyboard
codes searcher&.
&NV-items& section&
-& you can backup/restore any amount of NV-items in this section.
Doing so you can backup/restore all phone settings: user settings,
network settings, security settings, RF calibrations, etc. Also, CDMA
Workshop has ability and specially developed by us mechanism to make
FULL backup of NV-items for models which restart at trying of access to
some of NV-items (see details in &nv_skip_list.txt& file).
&Flash& section&
-& these functions use bootloaders for different MSM chipsets in
order to Read/Write flash-memory directly in flash-chip. By using these
functions you can create your own collection of full-flashes and use
them to upgrade firmware, as well as to repair phones with &software&
problems (corrupted EFS, etc). Supported chipsets: MSM , 5100,
// (ZTE / Axesstel).
Hiewer& -&
full-functional Hex memory viewer and editor. You can browse,
investigate phones memory in visual manner and even edit phones RAM,
EEPROM, and NV-items directly in real-time.
&Security& tab& -&
section& -&
you can read/write and send SPC (Service Provider Code) unlock code to a
device here.
All CDMA phones are locked by using of SPC. You must unlock phone by
using &SPC - Send& button, before writing: network settings, PRL,
NV-items, etc. CDMA Workshop will show a notification message
automatically if a phone require SPC to be entered before such
operations. Once phone is unlocked you can change SPC to any other value
&Universal RAM& method
can search and extract all 6-digit security codes (SPC, MSL, FSC,
Minlock, etc) directly from RAM memory. Security codes always located
somewhere in RAM memory. This method is very powerful and used for
models for which security codes cannot be read by the other methods:
models which have no any EFS support, old models or models which use
locked EFS. (ex. all new Sanyo models, HTC,
BlackBerry, Treo/Palm models, Sierra AirCards, Novatel modems, etc)
&Universal EFS&
method reads security codes directly from EFS system files. It
automatically detects and supports both access types EFS1 and EFS2, both
structures of system files in EFS, older and newer, all known possible
locations. It will read all 6-digit (SPC, FSC, OTKSL, etc) and 4-digit
(user lock) security codes. Also, if you did some research and know
where (in which EFS file) security codes are located for specific model
or series, then you can add your own custom EFS paths to the list where
<> method will search security codes (see
&spc_efs_paths.txt& file for more details).
&Universal EFS_RAW&
method - one more powerful universal fully automated method. Manufacturers
in newer models may lock regular access to system files in EFS (where
security codes are located) and access to a RAM memory so the above
universal methods will not work, but we still have a chance to read EFS
in low-level RAW format, sector by sector, and extract SPC from the
resulting dump. You can use this method for wide range of different
brands and models, just for example: LG
VN150PP, VX5600PP, VX8550, VX9700.. Kyocera E2000, K433L, K494L..
Audiovox 8945.. BlackBerry 8703e, 8830we.. Palm Treo 800w, Centro..
Samsung A700, M500, R500, R560, U360, U640.. Huawei M635, M735.. modems
Huawei EC122, EC156, EC168, EC228, EC360.. Franklin U210, U300, U600
(C-motech, Sprint).. Sierra 250U, 597, 598U..
Cal-Comp A600.. MDM9600 part of LTE HTC models Thunderbolt, Rezound..
and much more.
&Universal RAM_3A&
- this method is mostly supported by newer devices. For example, you can
use this method on: Novatel PC770 (Merlin),
C777, U727, U760, MiFi2200, etc..
Huawei M635, M735.. Kyocera S3015 Brio, etc.
& - &Default (nv_read)& - the standard method. Allow to
read SPC in many cases once your phone is unlocked with using internal
security password (see list of passwords in &Passwords (16 digits)&
section). It is used for wide range of different brands and models, such
as: Audiovox, Hyundai, Sky, Pantech, Sierra
modems, and especially Samsung models including newest Android models.
& - &LG method& - you can read SPC on most LG models by
using this method.
& - &HTC method& - you can read SPC on most HTC models
including newest Android models (ex. HTC-6700,
, , Touch Pro 2, Evo 4G, Evo 3D, Thunderbolt,
Rezound, etc) and
Palm Treo 850 Pro (HTC based).
& - &Motorola method& - this method is universal for many
Motorola models. You can use this method to read SPC, MSL, and user lock
for many Motorola models with &syn_feature& file in EFS (ex.
C290, V710, E815, V3c, V3m, K1m, V9m, and many other models
(non-locked EFS only)).
& - &C-motech method& - you can read SPC on many of
C-motech (Franklin) modems by using this method (ex.
C-motech U300, CDU-550, CDU-650, CDU-680, etc).
& - &SonyEricsson& - you can read SPC on all SonyEricsson
models by using this method (ex. SonyEricsson
T606, T608, etc).
& - &Kyocera Minlock (SPC3)& - this is a universal
automatic method, used to read Minlock unlock code (also known as SPC3)
on Kyocera models based on EFS1 (ex. KX1,
KX4x4 / KE4x4, SE44, SE47, etc). For newer Kyocera models
you can use &Universal RAM& and &Universal EFS& methods to read SPC3.
& - &Direct EEPROM& - this method is quite similar
&Universal RAM& method, but designed to work with EEPROM. Sometimes
security codes are located in EEPROM (ex. old
models, old Samsung models, all LG models, etc).
P.S. The other available methods of reading SPC, please check in Demo
section& -&
you can change ESN (Electronic Serial Number) here. This function is
useful to repair damaged ESN.
&Universal RAM& method
will search all ESN addresses in RAM memory and save them to a file,
after that it will use these addresses to write new ESN directly. This
method is very useful to use and must be used for brands and models for
which ESN cannot be changed by the other methods, such as:
Epsilon, Compal, Aiko, ZTE, Axesstel, Novatel data
cards, HTC, BlackBerry, Treo/Palm models, some of Samsung M-series,
and many other brands and models.
&Universal EFS&
method will work on the majority modern models based on non-locked
EFS2, such as: Samsung A700, M300, M500, R500,
U410, U540, etc..& Treo 700, 755, etc.. Audiovox/UtStarcom 6600,
, 7025, etc.. Kyocera K433L (K9), K494, KPC680 EVDO modem, etc,
LG models, korean Samsung SCH-V, S-series, Motorola MS-series (ex.
MS400, MS500, etc), ZTE phones/data cards,
and many other brands and models.
&Universal EFSx&
method has the same power and universality as &Universal EFS&
method above, but intended for newer CDMA devices based on newer type of
structure of EFS. It will work for wide range of different brands and
models, just for example: Sierra 250U, 598U,
etc.. Pantech UM175, UM185, UMW190, UML290, etc.. Samsung SPH-M800,
M810, M820, M900, M910, U820, D700 Galaxy S Epic 4G, D710 Galaxy S2,
D720 Nexus S, P100 Galaxy Tab, etc..
Huawei M635, M735, etc, and much more other devices.
& - &Default (nv_write)& - the standard method. Allow to
change ESN in many cases once your phone is unlocked with using internal
security password (see list of passwords in &Passwords (16 digits)&
section). It is used for wide range of different brands and models, such
as: Audiovox, Hyundai, Sky, Pantech, and
especially Samsung models including newest Android models.
& - &Kyocera method& - this method is developed to work
with Kyocera models based on MSM chipsets up to MSM5100 (ex.
, , , S14, , ,
, SE44/SE47, Blade/Phantom, etc). For newer Kyocera
models you can use &Universal EFS& method.
& - &LG method& - you can write new ESN on most LG
(including newest) models by using this methods.
& - &HTC method& - you can write new ESN on most HTC
models including newest Android models (ex.
HTC-6950, XV6975, Evo 4G, Evo 3D, Incredible, Incredible 2, Thunderbolt,
Rezound, etc) and
Palm Treo 850 Pro (HTC based).
& - &Sanyo method& - you can write new ESN on Sanyo
models up to Sanyo 8300 by using this method (ex.
Sanyo , , , , etc).
& - &UTStarcom method& - you can write new ESN for many
of UTStarcom models by using this method (ex.
CDM-, , 120, 180, etc). This method is
useful when &Universal EFS& method does not work.
& - &Sierra Wireless cards method& - you can write new
ESN on most Sierra Wireless modems by using this methods (ex.
AC580/Audiovox PCU, 595, 597/MCU, etc).
& - &Huawei EC-series method& - you can write new ESN on
Huawei EC-series modems by using this method (ex.
Huawei EC122, EC156, EC168, EC228, EC360, etc).
& - &C-motech method& - you can write new ESN on C-motech
(Franklin) modems by using this method (ex.
C-motech CDU-550, CDU-650, CDU-680, etc).
& - &ZTE / Axesstel method& - you can write new ESN on
models based on MSM, 6000 chipset (ex.
C100, 150, 160, 170, 180, 190, 200, 201, 202, 204, 220, 230, 231, 401,
631, 632, 705, etc, etc. Nokia 1255). You can use this
method to write new ESN on many Axesstel models also (ex.
P800, L800, L1900, etc).
& - &VK Mobile& - you can write new ESN on most VK_Mobile
models by using this method (ex. VK-100c,
200c, 220c, 300c, 600c, 650c, x100, 700c, etc).
& - &Samsung EsnDev& - this method is used for Samsung
models for Korean, Asia and Oceania, Israeli, etc markets, such as:
SCH-X, E-series, some V-series and some A-series (ex.
Some brands and models use encrypted ESN inside and/or hide real ESN
and do not allow to read real ESN by standard methods (ex.
all Samsung SCH-V, S, B-series, Motorola MS-series, korean market LG
models, etc). You can use &Real ESN& option to read
real ESN for such models. This method is Universal
and can be used on any CDMA models.
You can see ESN prefix (ESN owner or phone manufacturer) in pop-up hint
by moving mouse cursor to the ESN field here also. This feature is very
useful to see - is the current ESN original or it already has once been
P.S. The other available methods of changing ESN, please check in Demo
section& -&
you can enable/disable and repair MEID (Mobile Equipment IDentifier)
here. When a device is MEID-based, then ESN is called pESN (pseudo ESN,
for backward compatibility purposes) and pESN must be matching current
CDMA Workshop will check pESN and MEID matching
at first reading of a phone and show a notification message
automatically if pESN and MEID are not matching each other. CDMA
Workshop will automatically re-calculate and write correct pESN at
changing MEID with using available methods. You can even disable using
MEID, in order to use MEID-based phones in ESN-based networks.
&Universal
method has the same principle of work as &Universal RAM& method in &ESN&
section, but designed to work with MEID-based phones. For example it
worked just fine for many of Palm, HTC, Blackberry models (ex.
Palm Treo 800w, Centro, Pre, Pixi.. HTC 6950 Diamond.. Blackberry 9530,&
&Universal EFS&
method will work on the majority modern models based on non-locked
EFS2, such as: Samsung, Kyocera, UTStarcom
models, etc.
&Universal EFSx&
method has the same power and universality as &Universal EFS&
method above, but intended for newer CDMA devices based on new type of
structure of EFS. It will work for wide range of different brands and
models, just for example: Sierra 250U, 598U,
etc.. Pantech UM175, UM185, UMW190, UML290, etc.. Samsung SPH-M800,
M810, M820, M900, M910, U820, D700 Galaxy S Epic 4G, D710 Galaxy S2,
D720 Nexus S, P100 Galaxy Tab, etc..
Huawei M635, M735, etc, and much more other devices.
& - &Default (nv_write)& - the standard method. Allow to
change MEID/pESN in many cases once your phone is unlocked with using
internal security password (see list of passwords in &Passwords (16
digits)& section). It is used for wide range of different brands and
models, such as: Audiovox, Hyundai, Sky,
Pantech, and especially Samsung models including newest Android models.
& - &LG method& - you can write new MEID/pESN on most LG
models (MEID-based) by using this method.
& - &HTC method& - you can write new MEID/pESN on most
HTC models including newest Android models (ex.
HTC-6950, XV6975, Evo 4G, Evo 3D, Incredible, Incredible 2, Thunderbolt,
Rezound, etc) and
Palm Treo 850 Pro (HTC based).
& - &Huawei EC-series method& - you can write new
MEID/pESN on Huawei EC-series modems by using this method (ex.
Huawei EC122, EC156, EC168, EC228, EC360, etc).
Some brands and models use encrypted MEID inside and/or hide real MEID
and do not allow to read real MEID by standard methods. You can use
&Real MEID& option to read real MEID for such models. This method
is Universal
and can be used on any CDMA models (MEID-based).
section& -&
The methods below to repair IMEI work absolutely in the same manner as
the same methods in &MEID& section, but just changed to operate with
IMEI instead of MEID. We do not have enough GSM devices for testing, let
us us know please where (on which models) these methods have worked and
where not.
& - &Default (nv_write)& - Regular &nv_write& command. In
many cases sending correct 16-digit security password will allow you to
use this method (ex. Pantech UMW190, UML290 3G
modems, Samsung U810, etc).
& - &LG method& - tested on
LG VL600 4G LTE modem.
&Universal EFSx&
- tested on Pantech UMW190, UML290 3G
modems, HTC 4G Thunderbold.
&Passwords (16 digits)&
section& -& some brands and
models are protected by special internal security password (16 digits).
You must send a valid password by using &Send& button for such models,
in order to unlock changing ESN, MEID/pESN, reading SPC/A-key by using
&Default& methods, as well as reading/writing RAM/EEPROM memory, etc
For example Kyocera, Sanyo, LG, etc do not use this kind of protection
in their models. Samsung Sprint models use the same password in
all their models, it is called &Samsung (default)& in the list of
passwords. The same password is used in many other Samsung models for
other networks, countries and regions (Latin America, Asia and Oceania,
etc). Sierra Wireless
devices use the same password in all their models (ex.
250U, 580, 595, 595U, 598U, 597/mc5725, pc5220, W801, W802S Mobile
Hotspot, etc), it is called &Sierra Wireless cards& in the
list of passwords. Also, you have opportunity to add very easily your
own passwords to the general list of passwords, upgrade and create your
own custom list of passwords.
&User Lock&
section& -& you can read/write 4-digit
user lock here, as well as enable and disable it.
& - &Default (nv_read)& - the standard method. Allow to
read user lock on most CDMA models.
& - &SonyEricsson& - specialized for SonyEricsson models
method (ex. SonyEricsson T606, T608, etc).
&Universal, NV-items&
method is actually very useful to read user locks on models which use
non-standard location of user lock in NV-items and where &Default
(nv_read)& method does not work (ex. Samsung
SPH-M300.., SCH-A650, A670.., SCH-R211, R350, R450, R560.., korean
market models SCH-X,E,V,S,B-series, chinese Hisense C177, C199, etc).
&CAVE& tab& -&
section& -& the A-key is used in
many CDMA networks in authentication process (besides a basic
authentication parameters - ESN (MEID) and phone number), in order to
avoid cloning. Security of the A-key is critical in such CDMA systems.
You can read original CAVE (Cellular Authentication and Voice
Encryption) keys and write new ones on this tab.
&Universal
RAM& method can search and extract authentication keys
directly from RAM memory. Authentication keys always located somewhere
in RAM memory. This method is used for models for which authentication
keys cannot be read by the other methods: models which have no any EFS
support, old models or models which use locked EFS.
&Universal
EFS& method reads CAVE keys directly from EFS system files.
It automatically detects and supports both access types EFS1 and EFS2,
both structures of system files in EFS, older and newer.
&Universal
EFS_RAW& method has the same power and universality as
&Universal EFS_RAW& method in &SPC& section, will work for the same
models, but just intended to read authentication keys A-key, SSD_A,
SSD_B instead of security codes. This method uses heuristic algorithms
and as a result supports both structures of system files in EFS, older
and newer, thus you will be able to operate with even older models also.
&Universal
RAM_3A& - same as above method.
& - &Default (nv_read)& - the
standard method. Allow to read authentication keys in many cases once
your phone is unlocked with using internal security password (see list
of passwords in &Passwords (16 digits)& section). It is used for wide
range of different brands and models, such as:
Audiovox, Hyundai, Sky, Pantech, Sierra modems, and especially Samsung
models including newest Android models.
& - &LG method& - you can read
authentication keys on most LG models by using this method.
& - &Novatel/Merlin modems&
- you can write (non-standard algorithm) new authentication keys on all
Novatel/Merlin modems by using this
method (ex. Novatel PC770 (Merlin), U720,
V720, S720, EX720, U727, U760, MiFi2200, etc).
& - &UTStarcom method& - you can
read authentication keys on many of UTStarcom models by using this
method (ex. CDM-, , 120,
180, etc).
& - &SonyEricsson method&
- you can read authentication keys on all SonyEricsson models by using
this method.
&A-key chksm calculator&
section& -& you can generate a valid
6-digit checksum for A-key, in this section. This is sometimes required
for testing the phone&#39;s A-key entry function, as well as for the phone&#39;s
activation. It used to be possible to obtain a valid A-key with checksum
only from the cellular operator itself, now everyone can easily generate
the secret checksum value, enter those numbers into the phone just using
the phone&#39;s keypad. When you want to program the new A-key into the
phone over the keypad, you must enter 26 digits (20 digits A-key in Dec
+ 6-digit checksum). Our A-key checksum calculator supports both ESN and
MEID-based (only for CDMA Workshop
users) devices (ex.
all HTC smartphones).
&Other& tab& -&
section - you can read and write PRL files
(Preferred Roaming List) here.
& - &Read& - you can read PRL from any
existing worked phone and create your own collection of PRL files for
each network you necessary.
& - &Write& - use available methods to
write PRL: Universal method for most CDMA phones,
LG and Sanyo - non-standard native methods
especially for LG and Sanyo models.
section - you can make a rebuild of all
internal settings/EFS in this section.
& - &Default (Samsung)& - method was designed for
Samsung models only, but this method, as based on standard
Qualcomm algorithms, is working and may work for many other brands and
models also, such as: Withus, Epsilon, Compal,
Audiovox, etc. Just try it on your models, it may work.
& - &Sanyo& - method will Reset/Rebuild EFS for new
models started from Sanyo 8300, it will also open locked EFS and reset
all security codes to default values. Rebuild EFS is necessary in order
to change ESN on new Sanyo models also.
& - &Huawei EC-series& - method will do full rebuild on
Huawei EC-series modem (ex. Huawei EC122,
EC156, EC168, EC228, EC360, etc), all settings will be reset
(SPC, ESN, MEID, network settings, etc).
& - &Novatel/Merlin modems& - method will do full rebuild
on many of Novatel/Merlin modems/routers (ex.
Novatel S620, S720, PC770, C777 (Merlin), MiFi2200, etc).
&Universal EFSx& -
method is one more newest powerful method which will do full rebuild
(network settings, PRL, A-key, serial and security codes, etc) for
almost all brands and models where &Universal EFSx& methods to change
MEID/ESN are working (see above, Samsung
models, Pantech modems, etc).
&Keypad emulator&
page - this is a keypad emulator tool.
&Display capture&
page - this is a display capture tool.
&Terminal& tab& -&
This is CDMA low-level terminal for advanced
users, which allow you to send Qualcomm DM commands and receive answers
from a handset in Hex and ASCII format. It is useful in different
investigations and custom situations, for example it allow you to repair
damaged SPC, when a handset does not accept any SPC (because it is
damaged inside a handset, consists not only of one digits). It has a
counter of total amount of bytes in packets (commands), automatic CRC
calculation and commands history, in order to facilitate usage.
You also have opportunity to create and run
scripts with AT and DM commands. If you have some knowledge and know AT
modem or especially Qualcomm DM commands, then you can embody your own
actions or algorithms which even are not present in CDMA Workshop.
&Monitor& tab& -&
The &Real-time network monitor& function is
allow you to observe online/offline phone activity and status. This
function is very useful to finding and solving problems with non-correct
phone programming, when a phone cannot make calls or cannot find
By purchasing a software you will receive:
Full functional software, unlimited use.
personal or company registration key for one PC.
will need an internet connection (protection and licensing system).
Ability to activate/deactivate your license and to move software to any
other PC you want.
Ability to upgrade your current PC with new components and get a new
license key.
special account to download the new versions of software. This account
will expire in 12 months.
credits or logs, no monthly/yearly fee. Fully unlimited solution. Pay
once - use lifetime.
for delivery (downloadable from our site).
Lifetime e-mail technical support.
If you want to buy this program for several computers and want to get a
volume discount, please . We offer
up to 49% discounts.
You also have opportunity to re-sell used copies of CDMA Workshop. The
copy will be fully re-registered to a new person or company.
CDMA Workshop is always in a development stage and adding new features
and algorithms, we are working hard on every new version and we shall
gladly accept and consider your custom requests, suggestions, ideas or
bug reports in order to make CDMA Workshop more powerful.
CDMA Workshop cost 108$ only
You can buy complete CDMA solution with
Newsletter