Help How to Network unlock your Samsung i5800/i5801 using ADB

[bjlabuk]

How to network unlock your Samsung i5800/i5801 phone using ADB

(or not as the case may be! Please read the entire thread before starting.)

Firstly, if you are concerned that unlocking your phone will void your warranty with your network carrier/provider, instructions are included at the end on how to re-lock your phone to your chosen carrier/provider.

Secondly, the instructions that follow do not harm you phone in anyway. You are simply copying a file from the phone to your PC and working on the file on your PC to extract the unlock code. The worst that can happen is that the program does not find the code. I have provided methods for rooted phones and non-rooted phones.

Thirdly, this guide is very detailed and is aimed at those new to Android phones and those with limited programming knowledge. There is plenty of explanation at each stage.

Preparation

ADB stands for Android Debug Bridge. The adb commands are meant to be run from the host machine (PC) that your phone is connected to via USB. The adb utility is installed automatically if you install the Android SDK (Software Development Kit) on your host machine. If you don’t want to install the full Android SDK you can install smaller tools which contain the adb utility.

The one we are going to install is AndroidControl, a tool developed by the xda-developers and available to download from their forum at

[TOOL] AndroidControl v1.3 - control your Android - xda-developers

Registration is free. Download it and install it to a drive/folder on your PC which is easy to find. For example you could create a folder called ‘Workbench’ on the C: drive.

For phones that are rooted

Download the tool Samsung Galaxy Unlock code eXtractor SGUX2.exe file. It's a win32 executable.

You can download sguX2.exe (v.0.92b) at: Multiupload.com - upload your files to multiple file hosting sites!

For phones that are NOT rooted

Download the tool Generate Unlock Windows.zip which is a compressed file.

It can be downloaded from Generate Unlock Windows.zip

Once downloaded extract the .zip file. A folder(s) will be created in which there will be a Windows batch file called Generate_Code.

Step 1

On your phone, go to the keypad and type the code *#7465625#

On typing the last character # , a pop up screen should appear titled Personalisation status. You should see the following:

Network Lock (on/off)
Network Subset Lock (on/off)
Service Provider(SP) lock (on/off)
Corporate Service Provider (CP) Lock (on/off)

Only the Network Lock should be showing as ON.

Step 2

On your PC, depending on your version of Windows, go to Start >All programs > Accessories and open Command prompt. Alternatively go to Start > Run and type cmd and hit <enter>.

This will take you to the Windows Command Prompt (it replaces the MS-DOS command prompt if you are old enough to remember it!). It will look something like

C:\Users\your_name>

You need to locate the drive/directory where you saved AndroidControl.

If you are unfamiliar with Windows / MS DOS commands the following should help:

To change drive, eg to drive E, type E: and hit <enter>.
To change to the root directory of a drive, type cd \ and hit <enter>
To change to another director/sub directory type the path
eg cd \Workbench\AndroidControl_v1.3 and hit<enter>
To see the contents of a directory type dir and hit <enter>

You are looking for the sub-directory in which adb.exe file is located. Mine is located in the directory AndroidControl_v1.3 itself.

Once located you should have a command prompt similar to:

C:\Workbench\AndroidControl_v1.3>

Step 3

Set your phone into USB debugging mode by going to Applications > Settings > Development > USB Debugging.

Step 4

Connect your phone to a USB port on your PC using the cable.

Step 5

Back on the computer, at the Windows command prompt

C:\Workbench\AndroidControl_v1.3>

type adb devices and hit <enter>

It should show your phone listed on one of the ports, eg:

List of devices attached
644298c722a9 device

Note: If you run adb devices and it comes back with an empty list, then make sure you have set the phone into USB debugging mode (Application > Settings > Development > USB Debugging) before connecting it to the PC.

Once successful with the above step

type adb Shell and hit <Enter>

the command prompt will change to #

Now type su and hit <Enter>

Back on your phone screen, if your phone is NOT rooted, you should see a pop up message for "Superuser Permission" (try to keep your screen on. The timer automatically turns the screen off, so you might miss the pop up message). "grant it permission" to allow, else you will get a "permission denied" ). If your phone is rooted, nothing will appear on your screen as you already have Superuser permission !

Step 6

If your phone is rooted

On the ADB shell command prompt #

type cd /dev/block and hit <Enter> (Note the change from \ to / )

Then type dd if=/dev/block/bml3 of=/sdcard/bml3.bak and hit <Enter>

The dd command line says, "Reading from the input file /dev/block/bml3 on the phone, write all of the data to the output file /sdcard/bml3.bak to be created on the sd card",

which effectively is making a backup copy of the bml3 file and storing it on the root of the sd card. You should get something like:

Code:
20480+0 records in
20480+0 records out
10485760 bytes transferred in 0.826 secs (12694624 bytes/sec)

If your phone is not rooted

On the ADB shell command prompt #

type cd /efs and hit <enter>

Then type dd if=/efs/nv_data.bin of=/sdcard/nv_data.bin and hit <enter>

The dd command line is explained above.

You should get something like:

Code:
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.633 secs (828259 bytes/sec)


bml3.bak or nv_data.bin is now on the root of your sd card.


Step 7

Now, on your phone disable USB debugging by going to Applications > Settings > Applications > Development > USB debugging. Unplug the USB cable from the phone.

Step 8

Plug the USB cable back to the phone. Now go to Settings > Wireless and Network > USB settings and choose USB Mass Storage mode.

Accept the choice to copy files between your device and PC. A pop-up window should appear on your Windows desktop (called 'Autoplay'). Choose the option 'Open folder to view files using Windows Explorer'. You should now see your phone as a 'Removable Drive' and should see the the bml3.bak or nv_data.bin file listed. Using Windows Explorer copy the file from the sd card to your PC.

If your phone is rooted

Copy the bml3.bak file from the internal SD card to your working folder on your PC where you have downloaded SGUX2.exe file

If your phone is NOT rooted

Copy the nv_data.bin file from the internal SD card to your working folder on your PC where the Generate_Code batch file is located.

Step 9

Back on the Windows Command Prompt screen we have finished with ADB, so type exit at both the # and $ prompts to completely clear the PC from the phone. You should now be back to the MS DOS command prompt C:\Workbench\AndroidControl_v1.3>

Step 10

If your phone is rooted

change directory to the folder where you have the SGUX2.exe file and the bml3.bak file (they should be in the same folder).

type sgux2.exe bml3.bak and hit <enter>

You should get something like this

SGUX v0.92b (C) 2010 By Mark0 & rbnet
Samsung Galaxy Unlock code eXtractor
(based on info by rhcp0112345 & RazvanG)

Opening file <bml3.bak>...
Searching code block...
Found.
Searching codes...

Freeze code : 98765432
Network Control Key: 12345678


Take a note of both the Freeze Code and the NCK (Network Control Key)

If your phone is NOT rooted

change directory to the folder where you have the Generate_Code batch file and nv_data.bin file (they should be in the same folder)

type Generate_Code.bat and hit <enter>

Look for the line

Network Control Key:YourCode

Take a note of the Code.

Step 11

Cancel the USB storage mode and disconnect the USB cable.

Power off your phone.

Put in a SIM card from another carrier / provider

Power the phone back on.

When it boots up it will ask for the unlock code. Enter the NCK (Network Control Key) code you found in Step 10.

It should say "Requesting network unlock" followed by "Network unlock successful"

Done, the phone should now be unlocked.


HOW TO RE-LOCK SAMSUNG Apollo – FOR WARRANTY PURPOSES ONLY (TESTED)

After you get the NCK code using the method above,

use the phone keypad and type *7465625*638*#

A pop-up box will appear with two boxes:

MCC/MNC and
Control Key

MCC/MNC stands for Mobile Country Code and Mobile Network Code. The codes can be found on the internet eg at

UnlockMe - Mobile Network Provider Codes MCC & MNC - Unlock Code

or

http://users.zipworld.com.au/~rmills/MCCandMNCValues.htm

Complete the first box (MCC/MNC) with the country and network code you want your phone locked to (eg. 22610 where 226 = romania; 10 = orange etc.).

Complete the second field (Control Key) with the NCK code you obtained.

Press OK and your phone should relock.

References:

[REF] How to: Extract "Freeze Code" for Free [NOT_UPDATED_ANYMORE] - xda-developers
[HOWTO] Software Unlock; How to unlock Bell Galaxy S Vibrant i9000M - xda-developers
[REF] How to unlock/unfreeze all SGS Models [NOW WORKS ON Vibrant 4G][Updated 4-9-11] - xda-developers

 

[MrMister]

Wow thanks for the detailed post I hope it works when my Orange locked i5801 arrives as I need it network unlocked.

I asked in another post in here if it was possible to network unlock but replies said best to goto a stall that do them and pay around

 

[bjlabuk]

'Going to the stall' was the short easy answer !

But when I did a bit of digging I found this method. It should work for you if you follow the Not rooted instructions.

bjl

 

[MrMister]

OK got phone, updated it to v2.2 officially as still on Orange at moment.

Followed these instruction, get adb devices list, but when I type adb shell, I get the $ sign not the # sign above. I then typed su anyway after the $ sign and says su: not found.

I have the usb debugging mode ticked. can you help?

cheers

 

[verybigtiger]

Hi bjlabuk,
I came across your writting for the unlocking prodedure and its a very nice ... thanks for that details.

I am trying to unlock my "galaxy s Fascinate" using your steps. When I came to the step for getting su access it did not take it. The su is not their in the bin directory and also the directories are in a read-only state.

I hope that I can get your help in getting this phone to be unlocked.

thanks,
Joseph

 

[bjlabuk]

Okay,

Not sure what you mean by "The su is not their in the bin directory and also the directories are in a read-only state."

The file you are looking for is nv_data.bin and it is in the /efs directory.

Make sure when you type the command su on your PC that you are watching your phone screen for the 'permission allow' message.

If that still doesn't work, then from the MS-DOS command prompt type:

adb pull /efs/nv_data.bin

(adb pull copies the specified file from your phone to the directory on your computer where you ran the adb command from)

If you receive a permission denied error, you can fix it by typing the following commands from an ADB shell (type "adb shell" at the DOS command prompt):

su
chmod 777 /efs/nv_data.bin
exit
exit

(chmod changes the permissions of each given file according to mode. chmod 777 <file> allows everyone to read, write, and execute <file>.)

Then from the DOS command prompt:

adb pull /efs/nv_data.bin

This should copy the nv_data.bin file to you computer.

If you don't like the idea of using chmod 777, then try using AndroidControl which you downloaded at the start. Remember to put your phone into USB debug mode.

Failing all the above the simplest answer would be to root your phone which you can do with Superoneclick at

[APP]SuperOneClick v1.9.1 (Root, Unroot, Enable Non-Market App) - xda-developers


bjlabuk

 

[MrMister]

Will try, but I get the $ sign not the # sign as you say, does it matter? Also as soon as I type su it says not found

 

[bjlabuk]

MrMrMr

Tried it on my own phone from the Androidcontrol_v1.3 folder. Typed adb shell and get the # prompt so not quite sure why you are getting $.

Then tried from the MS-DOS prompt C:\Workbench\AndroidControl_v1.3>

adb pull /efs/nv_data.bin

and got

1426 kb/s <524288 bytes in 0.358s>

Then typed dir

and nv_data.bin is listed in the AndroidControl_v1.3 folder.

bjlabuk

 

[MrMister]

Ok will try again when I get in, thanks for help though. So either way will work (command above I mean)

Unsure how I'm getting a $ sign but I am!?!

Cheers

 

[sajd]

I successfully made the 9 steps but when i came to the 10 step it gives me just this code

SGUX v0.92b (C) 2010 By Mark0 & rbnet
Samsung Galaxy Unlock code eXtractor
(based on info by rhcp0112345 & RazvanG)

Opening file <bml3.bak>...
Searching code block...

the sgux2.exe and the bml3.bak file from the sd card are in the same directory,some help?

 

[MrMister]

still not working for me, I have a bin file after typing "adb pull /efs/nv_data.bin" but now what do I do with it please? it says its 0 bytes in the folder

 

[sajd]

Oh... you dont understand anything of this, do you? look, su is to get in root of the android on the phone, and after get from there the nv_data.bin or blm3.bak file. In your case with the command adb pull /efs/nv_data.bin you take that nv_date.bin file from the telephone and it's copied on your location (ex. D:\Android\AndroidControl ). Go to your correct location and you will see that file into it.After that make the 10 step from this tutorial, for me it isnt work.

btw if you want to try to work with the SU command first you have to root your telephone. And here is a LINK how can you do that if you want to try. I hoped i help you ...

 

[bjlabuk]

MrMrMr,

If it says 0 bytes then nothing has copied. Try the command

cat /efs/nv_data.bin > /sdcard/nv_data.bin

which says "copy the file .. to the sdcard and call the file....". Then copy it from the sdcard to your PC.

Sajd

if SGUX is not working you may have to manually search for the unlock code using a Hex Editor. Have a look at

Unlock Samsung Galaxy S 4G [Step-By-Step Guide]

and the screen shot of the Hex Editor. I downloaded the freeware HxD Hexeditor

and used the search facility to search for the text string

FF FF FF FF 01 00 00 00 00

I found it opposite offset value 00006c40.

The unlock code should be in the third column on the same line.

bjlabuk

 

[MrMister]

ok the file is 512Kb now. I then copied it to the folder for Generate Unlock Windows, ran the "Generate_Code.bat" and it just says...see screenshot

I opened the nv_data.bin in that hex editor, results around address you said are on screenshot, not sure what the results are or if I've done it correct.

did you see the last screenshot where I get $ sign? any ideas?

 

[MrMister]

Ive used the command adb pull /efs/nv_data.bin and get the bin file on my PC fine now. Ive opened up the bin file on 2 hex editors, and searched the string, but theres no code beside it, please see the screenshots.

Why dont I have a code? whats gone wrong? any more help greatly appreciated, need it unlocked asap to test

cheers

 

[sajd]

I tried to do with hex but it wasnt succesful ( i cant find the FF FF FF FF 01 00 00 00 00, it gives me a "NO OCCURRENCES OF ' FF FF FF FF 01 00 00 00 00 ' FOUND".

 

[verybigtiger]

When I issue the su command it says its not found.. weither theirs no access for the directories .. no permission ... I tried the cat command but the eft directory is not access .. I do not have right for ... I can see it though. any utility that can let me get a su rights?? I trid the froy and frozend.

 

[bjlabuk]

Sajd

Make sure you set BYTES TO &#8220;32&#8243;and that the Char Set is ANSI.

In the Search field make sure Data-type is 'hex-values' and the Search Direction is 'All'.

You should get one or more hits, so press 'Find again' to move through each one.
until you have been through them all.

If you look at your Hex editor there are 3 window panes on the highlighted line.


The left hand pane - offset value, eg 4CCC60h
The middle pane - Hex Keys, eg FF FF FF FF 01 00 00 00 00
The right hand pane - ANSI text ,eg yyyyyyyyy where the code should be.


You are looking for an 8 digit code in the right hand pane. This is your unlock code NCK for your phone.


If all that fails then I can't think of anything else without altering the files on your phone. See

http://forum.xda-developers.com/showthread.php?t=761045

but you do this at your risk.

It might be simpler paying the

 

[sajd]

If i attach the file here will you see it for me? I would be very happy

 

[MrMister]

Any help for me please? Can find the Hex string but there's no code in the RH column. Please screenshots I attached above.

Cheers

 

[bjlabuk]

Sajd / MrMrMr

I can't offer any other suggestions. If the two extraction programs aren't working and the hexEditor doesn't show the codes clearly then I think you are going to have to go to a shop.

Sorry.

bjlabuk

 

[verybigtiger]

hello bjlabuk and all,
I was able to root and got the #. then used su.
I was able to get the bml3.bak.
when downloading the sgux2.exe ... I got a message about a torajan viruse from any where I went to get on the net... I'm not sure the one that I got after all is clean but when used "sgux2 bml3.bak" it bring nothing back.
any advise would be appreciated. also I can open the file in the Hexeditor and see some numbers but they are not matching the tutorial... any suggestion guys would be appreciated.

Joseph

 

[bjlabuk]

To all,

By way of explanation when I bought my own i5800 it was SIM free and unbranded. I produced the above tutorial after following all the steps myself up to Stage 10 when I got the same message as Sajd:

SGUX v0.92b (C) 2010 By Mark0 & rbnet
Samsung Galaxy Unlock code eXtractor
(based on info by rhcp0112345 & RazvanG)

Opening file <bml3.bak>...
Searching code block..

I thought the program wasn't finding the code because my phone was already unlocked to all networks. I made the assumption that the programs would work on locked phones. It looks like I was wrong.

Even looking for the code manually using the HexEditor appears to be unsuccessful, so either (i)the code is there but we are not looking for it in the right place, or (ii) there is no unlock code stored.

It appears that on some Samsung Galaxy models the unlock code is stored in one of the files mentioned, but on others it is not - it is stored on a secure remote server. It looks like the SG3 is one of those phones, although I haven't found anything on the internet to confirm this. If that is the case then the only way to get the unlock code is by paying for it or asking your carrier / provider to supply it.

bjlabuk

 

[epsilonnosis]

i have a problem, i cant see my i5800 listed as a device by the command adb devices at step 5 and debugger usb mode is enabel on my phone.

i read in other threads something about a special windows usb driver to be use but i installed android sdk and see many other webs and i am stuck in this step, can anybody tell me where can i download it?

 

[bjlabuk]

You need the latest Windows USB drivers. You get them by installing the latest version of Samsung Kies.

By all means follow the steps, but I don't think you will find the unlock code. I have found a comment on the XDA developers website that basically says that the unlock methods for SGS phones don't work for the i5800/i5801 phones because the nv_data.bin file is different from them. Sorry.

bjlabuk