Wednesday, 22 August 2012

How to read your SPC/MSL code for carrier locked phone

This is often the first step we need to do when we have a smartphone locked to specific carrier (Telecommunications Service Provider), especially in CDMA phones, it is often that carrier will lock the phone to their specific programming code. This is normally because the carrier subsidy the phone and sell it at very cheap price (sometime "free" phone) with 12-24 months contract.

The Service Programming Code (SPC) or Master Subsidy Lock (MSL) are usually consist of a 6 digit code (GSM) or 16 digit code (Blackberry).

There's few way to know what is the SPC/MSL code:

  1. Ask the Service Provider (Carrier)
    • Some customer usually will ask this by the reason of travelling to a country where the current provider do not have Roaming agreement with.
    • The Carrier usually will ask for IMEI (International Mobile Equipment Identity), which can be located at back of the phone, visible after remove the battery or we may press *#06# from phone keypad. 
  2. Spend USD10 and get 3rd party to unlock your phone (ebay.com, etc..)
  3. To find the code by yourself.
In this 3rd option, we will use one of most famous method use in xda-developer, by using RadioComn. The original thread can be found at http://forum.xda-developers.com/showthread.php?t=1365058

  1. Download the specific USB Driver according to the Windows PC you are using.
  2. Download RadioComm  ( I am using RadioComm_11.12.2)
  3. Start the phone is cold boot (for my Photon 4G, I have to off the phone then press "vol.down+power" few seconds to force  into fastboot, press "vol.down" few time until I reach "BP Tools" then press "power up" to select this mode).
  4. Connect your Phone with USB cable.
  5. Start the RadioComm, in start page I will select MSM6800 (since I am using Motorola Photon 4G for experiment) RadioComm will bring you to main page, you may verify that your selection was right "Main >> MA >> CDMA1X >> Wimax (MSM6800)".
  6. Make sure the USB connection is "PST USB USB:MB855" or something like that.
  7. Select tab "P2K1"
  8. At left side navigate to STELEM/RDELEM section and input the following into each parameter:
    • Eloement ID : 2786
    • Record # : 0001
    • Offset : 0000
    • Length : 000E
  9. Observer that indicator at top right shall turn into "Green" colour then Press "RDELEM" button.
  10. You shall see at "Data (Hex Only" the result will be the SPC/MSL code encoded in Hex format, you may need to convert it to Decimal format (Dec) at this website :  
    • http://www.string-functions.com/hex-string.aspx
    • http://home2.paulschou.net/tools/xlate/  
    • copy and paste the code at {Hex] section and click "decode" and see the result at [Text] area. 
    • Just note the 6 or 8 or 16 digit of human readable character (my Photon 4G gave me 6 digit of number of human readable character).
Good luck.



4 comments:

  1. Sounds so promising, but how can you apply the principle to a Motorola Defy XT? Using PST USB makes it reboot the moment I plug it in and then it goes to a screen with the HW model, SW Version,etc. so I have to change the USB to MLink to get my phone to behave. What determines the Element I.D.?

    ReplyDelete
  2. Sorry been long time since I abonded this blog..
    I do not have the Defy XT to play around..
    I will do some research.. if you still has this problem..

    ReplyDelete
  3. how you put your defy xt in a diag mode??

    ReplyDelete