:^/ I believe you're correct, but I don't know what the original password is, so I'm not sure where to find it. nvm_data has about seven URL's and passworRAB, which I believe can also be modified via ##DATA#. For those, the orginal passworRAB are "secret," which I infer Sprint uses.
nvm_hdr...