Running unsigned code on BREW devices/BREW runtime on Sprint devices

From Legacy Portable Computing Wiki

For reasons not yet known, Sprint devices up to a certain period have hidden BREW support, which can be found by dialing ##2739# and the 6-digit SPC (may also be called "MSL")

This doesn't seem to be manufacturer-specific, and the cutoff period of when this code started working is also unknown.

As this deals with multiple manufacturers, some may have complete guides, and some may not.


Currently compatible phones

These phones have the necessary requirements in order to work correctly for these guides:

  • LG Muziq - Fully working with no issues. Note that changing the ESN will break the default AppManager, you can add AppUI's files to /brew/mod/1073741846/ as well as renaming its own MIF to 1073741846.mif to remediate this.
  • Samsung SPH-M240 - Fully working with no issues.
  • Samsung SPH-M330 - Fully working with no issues.

Currently uncertain phones

These phones have the dial code, but have some limitation where the guides are not yet suitable for them:

  • Kyocera Rally - Dial code and MSL (SPC) entry works, but leads to a grey screen. More than likely all of the AppManager resources are not present in the EFS and there is no known way to add them back.
  • LG Rumor - Dial code works, SPC entry not yet tested.
  • Samsung SCH-R561 - Dial code and SPC entry work, ESN changing not yet tested.
  • Samsung SPH-M520 - Dial code and SPC entry work, but there is no known way to change the ESN. DFS doesn't work, and there is no $SYS.ESN file to hex edit.
  • Sanyo Katana DLX - Dial code and SPC entry work, but there is no known way to get EFS access.
  • Sanyo Katana Eclipse X - Dial code and SPC entry work, but there is no known way to get EFS access.
  • Sanyo PRO-700 - Dial code works, SPC entry not yet tested.

Currently incompatible phones

  • Samsung SPH-M390 - Dial code and MSL (SPC) entry don't appear to exist on this phone, thus when you enter the code, nothing happens. More than likely all of the AppManager resources are not present in the EFS and there is no known way to add them back. Nothing happens when it is connected with RevSkills either.

Prerequisites

A computer running Windows 7 or above

The necessary drivers for your phone (you may find them here)

A data cable for the phone

A hex editor program (e.g., HxD)

A known working 16-digit SP code for your model of phone (this GitHub link may have the ones for your phone)

DFS Evolution

BREW test signature .sig file

RevSkills (Bitpim can be used for EFS-related operations)

Samsung devices

For Samsung Sprint devices, follow the Running unsigned code on BREW devices/Samsung guide except for the DFS ESN changing part. Sprint Samsungs tend to lock the NVitem(s) dealing with changing the ESN, so this guide will go over a different way of doing that.

ESN Changing

Make sure you have followed the Samsung BREW guide carefully, including sending the 16-digit SP and 6-digit SPC before continuing!

In RevSkills, go to the EFS tab and hit Read Directories.

Once the files and folders are loaded, go to the nvm directory. The file to look for is $SYS.ESN; right click it and press Read file.

After saving the file somewhere, open it in a hex editor. This contains your ESN with the bytes reversed and you will want to change them to look like this:

As the test signature's matching ESN is AB2B3C4F, bytes 0x55 to 0x58 correspond to the ESN, but in reverse order.

Send this file back to the phone by right clicking $SYS.ESN in RevSkills and pressing Write File. Once this is done, restart your phone and set it up in RevSkills as needed (SP/SPC codes and so on).

Go to the CODE tab and press Read ESN. If everything went as planned, your ESN should now be AB2B3C4F.

At this point, you can go back to the Samsung BREW guide to follow how to sideload your own apps.

SPC Changing (optional)

While not required, it may get annoying to enter the phone's specific SPC every time you want to run BREW apps. Fortunately, changing the SPC to all zeros is a trivial task.

Set up RevSkills as instructed previously, go to the CODE tab and press "Change SPC".

Press "Read SPC". If the reported SPC is 000000, then the change applied successfully!