siemens AL21 unlocked OK with Joker

[sorinm]

testpoint same as CF110
here it is:

Get Info...
HWID: 250 (Unknown)
AL21 lg1 Sw07 30.03.06 18:56:33
IMEI: 35916XXXXXXXXX
DisplayID: 62, Sharp Nec PD161700
Code(05): OTP closed
Code(0A): BootKEY misses in EEPROM
Code(0D): Keys are registered in BCORE
Code(10): Minimal access to BFB
Code(15): Complete condition
Code(19): Monitoring is switched on
Code(1D): Blocks 5121,5122,5123 are present
Battery Voltage very low! 3632 mV!
SecurityMode: Customer
DSP Firmware Version 00, Power Asic Project ID: BB, RF Chipset ID: 0A
EELITE Info: free buffer 88192 bytes, free at all 109990 bytes, free for deleted 109990 bytes.
EEFULL Info: free buffer 90724 bytes, free at all 224284 bytes, free for deleted 93356 bytes.
Battery Ri measurement: CutOff Idle: 3417mV, CutOff Talk: 3535mV, CutOff Idle: 3395mV, CutOff Talk: 3565mV, CutOff Idle: 3415mV, CutOff Talk: 3535mV, CutOff Idle: 3415mV, CutOff Talk: 3535mV.
Operating time: Total 65411 sec, Current SW 65411 sec.
Talk time: Total 547 sec, Current SW 547 sec.
CSD: Total 0 bytes, Current SW 0 bytes.
GPRS: Total 0 bytes, Current SW 0 bytes.
......................................................................................................
Start...
Loading BootsModel(AX75)...
Sending StartBoot Ok.
Sending MainBoot Ok.
Com3 460800 BAUD: Ok.
SIEMENS AL21 lg1 Sw07
Soft FlashID: 0001/2221
FlashID: 0001/227E-2221-2201
Flash Size: 16Mb, WriteBuffer: 32 bytes
Region(1): Blocks 128, Size 128Kb
Start EEPROM segments at addres 0x7A0000
FSN: 06F0D864 -> PhoneID: 64D8F006
OTP IMEI: 35916XXXXXXXXX
HASH: BDDCE9B4158E4594017C885B2E375588
Use OTP IMEI: 35916XXXXXXXXX
USE SKEY: 60411565
*#0000*12345678# - Network Lock
*#0001*12345678# - Service Provider Lock
*#0002*12345678# - Corporate Code
*#0003*12345678# - Phone Code
*#0004*12345678# - Network Subset Lock
*#0005*12345678# - Only Sim
BCORE HASH is equivalent - not change.
Read EEPROM addr: 0x7A0000 size: 0x060000...
EEPROM backup in ".\Backup\AL21lg1Sw07_EEPROM_XXXXXXXXXXXX.bin" file.
Write EEPROM addr: 0x7A0000 size: 0x060000...
Change BOOTKEY - Ok.
Change EEP0076 - Ok.
Change EEP5009 - Ok.
Change EEP5077 - Ok.
Change EEP5121 - Ok.
Change EEP5122 - Ok.
Change EEP5123 - Ok.


HAI POLI!!
sorinm

 

[Amir-SkillZ]

Cool INFo
u mean Select Ax75 in Model TAB wow

 

[sorinm]

ax72/75/CF110

HAI POLI!
sorinm

 

[systemworm]

What about test point?Does it have?

 

[KhOliO]

good work

many thx all info

keep it

 

[ednacell]

af51, al21
this models used mcu like AX72/75/C110.
so What TP to cut testpoint like ax75 or C110????.
cable below

 

[sorinm]

read above again

br
sorinm

 

[MADCIRA]

www.code-electronic.com

 

[stanner_austin]

JOKER USE SKEY 12345678

HOW YOU GET THIS SKEY 60411565?

I NEED INFO HOW TO GET SKEY? OF THIS PHONE?

 

[shahzaadbutt]

thanx for the link

i need it

 

[MADCIRA]

You are welcome mate.........

Regard goes to Zeljko Djordjic and his great work!!!





B.R.








MADCIRA

 

[sorinm]

use normal steps for unlock
1. make TP - same as cf110
2. calc SKEY
3. send SKEY
4. recalc all keys

 

[stanner_austin]

THANK YOU VERY MUCH.........NOW CLEAR

 

[FullFLASHgSMPH]

i will post if it success promiseeeeeeeeeee

 

[mrhoussem]

hii
please explain more the test point and skey calc

 

[BB-gsm]

2 and 3 can be ignored



Regards,
B

 

[gsmdreams]

Which cable should we use.

 

[wardenbaum]

Hi there, thanks for the test point images, im anouncing that i have made at May 07 2006 a Test Point colection, and i want to share it with my partners of this forum, it gon be out in my personal page, www.wsoftclub.tk under the section of mobile downloads, also you can browse for any contents that i have there, any post of reply is wellcome, also like contribute to the GSM cause. thanks

WAR

 

[Amir-SkillZ]

same for A31 Cable......................

 

[MR PROTEC]

yes u r true

@sorinm

thx for sharing bro

wbr