Rewrite MEID on Galaxy S2 Epic 4G Touch

I bought another Android smart phone on EBay to use on Ting Mobile. This one was a Samsung Galaxy S2 “Epic 4G Touch” SPH-D710. All excited, I looked in the phone information screen to get the MEID serial number, and entered it into the new phone activation screen on the Ting website. Ting told me it couldn’t activate a Boost Mobile clam shell phone. What the phreak?!?!

I looked at the phone’s label in the battery compartment. The MEID was different there. Ting told me that number was good, and belonged to this model. Argh. Somebody changed the serial number programmed into the phone. As far as the radio signals go, the cell tower thought this WAS a Boost Mobile clamshell phone talking to it.

Apparently someone previously had a Boost Mobile account with a cheap phone, and wanted to use this Galaxy S2 instead without changing their account, so they programmed the Boost Mobile phone’s MEID into the S2. (Strictly speaking, this is considered a no-no by the big carriers. They feel they have the right to charge you more for service on a fancier phone, for features you don’t use. If you don’t like that, you can use the old cruddy phone. If you don’t like it, use two tin cans and some string, as fas as they care.) I don’t have a problem with someone doing this number swap for themselves, but when you later go to sell the phone you should at least put it back to its original configuration so you don’t mess up the buyer. Like me. Grumble…

Ting runs on the Sprint network, and Sprint doesn’t allow Ting to activate phones from Sprint’s subsidiaries like Boost Mobile. I could not activate the Boost Mobile MEID on Ting, so I had two choices: ship the phone back to the EBay seller, or reprogram the MEID back to a usable one. I decided to try reprogramming it.

Lots of people put new versions of the software on their Android phone, also known as “flashing a new ROM”. Many people consider this to be obscure phone magic best left to hardcore nerds, even though it is usually easy to find the information for common phone models. The ebay seller of this phone had indicated it was flashed with alternate software, and I was fine with that. I knew I would have no problem with that, since I could reflash it back to the stock Samsung/Sprint software with no trouble if needed.

However, it gets much more complex when you change settings buried deep in the phone, such as radio controls or the MEID. The phone carriers and manufacturers as a rule do not want phone owners to change these values. Independent cell phone repair shops often have the software and expertise to do this, but at the individual or hobbyist level it is rather uncommon.

Fortunately, though, it is not impossible or unavailable; just difficult because of obscurity. The knowledge is scattered among many different Internet forum postings and bits and pieces of software notes. The details and techniques are different for every phone make, model, carrier, and software version. It takes a lot of digging and persistence. You have to be tenacious. Or just plain cheap and stubborn. (You already know where I fall on that spectrum.)

Sprint (and Verizon, and a few other minor carriers) use the CDMA radio system instead of the more-common GSM. The primary tool for changing the settings in Sprint phones is “CDMA Workshop”. I couldn’t get the free demo version to work, so I had to dig around to find other software. I could have spent $600 for the paid unlocked version of CDMA Workshop, but I didn’t find that to be a good value for fixing a phone worth less than $100, cheapskate that I am.

I found two pieces of software that would talk to my phone:

I also found that there were not one, but TWO passwords required to reprogram my phone. Drat and double-drat!

The first password needed is a six-digit number, called either the SPC or MSL code. I found some documentation that said they are the same, and other docs saying they are different. The various software programs call it the SPC, but seem to work correctly using the MSL value there. OK, whatever.

The normal situation with CDMA carriers like Sprint and Verizon is that they are the only ones who know your phone’s MSL code, and will not give it out willingly to you. That’s justified if they subsidized a portion of the cost of the phone, which is the case with most phone contracts in the US. But once you’ve fully paid for it and they still won’t give it out, they’re just being greedy corporate jerks. Enlightened, customer-friendly carriers like Ting will happily give it to their customers. Unfortunately, I could not get the MSL from Ting until I activated the phone, and I couldn’t activate the phone without reprogramming it, and I couldn’t reprogram it without the MSL password. Catch-22. Dang!

Fortunately, the first program cdmaDevTerm showed me that my SPC/MSL code had been reprogrammed into the phone to “000000”. This was the only convenient side effect of the earlier owner’s reprogramming. Apparently changing the SPC/MSL code to all zeroes is a common part of making these changes, which makes sense in retrospect. cdmaDevTerm tried it as a default action and it just happened to work.

cdmaDevTerm does not support the feature of reprogramming the MEID, but DFS Tool does. That’s when I discovered the second password requirement: an additional 16-digit password. Oh no.

Fortunately, more forum browsing indicated that there is just one of these 16-digit passwords per phone model (not per individual phone like the MSL). The password might possibly change with new software versions for the phone, but still all phones of the same model and software version would have the same passwords. I eventually found 16 Digit Password Issue in 4.1.2 Update – anyone else? which said that the password for my phone with the “Jelly Bean” software version is 2012112120131219. A forum poster said it worked for them on their Epic 4G Touch with Samsung ROM version GB27, which is what I was using.

Success! With that password, I was able to reprogram the MEID in the phone back to the proper one from the phone’s label. The phone activated immediately on Ting, and has been working fine for a week now. A bit of an ordeal, but a satisfying success in the end.

Leave a Reply

Your email address will not be published.