Part 4: SIM Unlock and Debranding

With root access and a filesystem dump in hand, two practical changes were next: removing the SIM lock and switching the carrier branding from T-Mobile to the generic DEFAULT profile.

SIM unlock page

The SIM unlock page lives in the ordinary web UI, not only in the hidden menus:

http://192.168.0.1/settings/mobile_network-sim.html

The interesting code path is in:

/usr/bin/QCMAP_Web_CLIENT

The unlock formula

For the older Franklin R717/T9, the known formula was:

echo -n "${IMEI}simlock" | sha1sum | cut -c1-8

That does not work on the RG2100. The missing ingredient is the model string. On this device, the working formula is:

echo -n "${IMEI}simlock${MODEL}" | sha1sum | cut -c1-8

For my unit:

IMEI=490154203237518
MODEL=RG2100

So:

echo -n "490154203237518simlockRG2100" | shasum -a 1 | cut -c1-8

Output:

9f02fe90

Entering that value on the SIM unlock page unlocked the device.

Pseudocode

The logic in QCMAP_Web_CLIENT is roughly:

imei = get_status_value("imei");
model = get_status_value("model");
input = imei + "simlock" + model;
digest = sha1(input);
unlock_code = first_8_hex_chars(digest);

if (submitted_code == unlock_code) {
    unlock_simlock();
}

The relevant live status file is:

/var/tmp/qcmap_status.cfg

Example values:

imei=490154203237518
model=RG2100
brand=TMOBILE
carrier=TMOBILE
fw_ver=RG2100.TM.M1639
mcc=234
mnc=20
plmn_id=23420

After unlocking, the device accepted a Smarty/Three UK SIM. APN configuration was still required, but the network lock itself was gone.

Carrier branding

The device started out T-Mobile branded:

/etc/data/current = TMOBILE
/etc/data/brand   = TMOBILE

Visible UI branding and some defaults come from the carrier/brand configuration. The factory reset helper is:

/usr/bin/fti_factory_reset.sh

This script is not a simple cosmetic switch. It also handles persistent identity values and defaults, including:

  • IMEI
  • Wi-Fi MAC addresses
  • Ethernet MAC address
  • SSIDs
  • WPA keys
  • Carrier brand
  • MCFG selection
  • APN/config defaults

Switching to DEFAULT

The command used to switch this unit to DEFAULT was:

adb shell 'sync; /usr/bin/fti_factory_reset.sh DEFAULT perm,all,reboot'

During the run, the script printed output such as:

CARRIER: DEFAULT
BRAND: DEFAULT
set USAGE_LIFETIME_COUNT_STR=0
brand_name[DEFAULT]mtd: successfully wrote block at 0
USB_MODE=9059
imei command = echo 490154203237518 > /tmp/imei_tmp
MAIN_SSID is RG2100a 8C70
MAIN_WPAKEY is ...
GUEST_SSID is RG2100b 2E50
GUEST_WPAKEY is ...
MAC 0 F16244D96C70
MAC 1 F16244DA6E50
ETHERNET_MAC is FFFFFFFFFFFF
The MAC address entered is invalid. Use Qualcomm default MAC address.
ETHERNET_MAC is 02567BB38DF3 (Qualcomm default)

It also warned that some DEFAULT config files did not exist:

cp: cannot stat `/etc/configs/default/DEFAULT/*.xml': No such file or directory
cp: cannot stat `/etc/configs/default/DEFAULT/*.ini': No such file or directory
cp: cannot stat `/etc/configs/default/DEFAULT/*.conf': No such file or directory

Even with those warnings, the device came back up and worked after manually adding APN settings. After debranding:

/etc/data/current = DEFAULT
/etc/data/brand   = DEFAULT
carrier=DEFAULT
brand=DEFAULT
fw_ver=RG2100.TM.M1639

Important: the firmware version remained RG2100.TM.M1639. This is a brand and configuration change, not a complete generic firmware conversion. It does not turn the modem firmware into a different regional SKU.

Continue to Part 5: Understanding OTA and PAC Format.

Leave a Reply