How to Move Your Epic 4G to the Virgin Mobile Network

Are you a recent Sprint convert now running on Virgin Mobile? If you have an extra phone lying around from your Sprint days you might be able to get it working on Virgin Mobile despite their normally short variety of phone choices. This guide in particular covers how to do it with the Epic 4G.

I’ve recently learned some basic phone modem programming knowledge and thought I would share.  The guide below will cover the basic requirements for getting an Epic 4G to run on Virgin Mobile with full Voice, SMS, and 3G Data coverage.

FAQ (frequently asked questions) – Read the FAQ first!

Scavenger Hunt Time, here are the tools you’ll need before we get started:

Item:Why you need it:
  • Samsung Intercept (Virgin Mobile) with a GOOD ESN number – Phone
This is the donor phone you need to activate Virgin Mobile service on.  You’ll have to have its MSID, MEID, HA key and AAA key to get service on your Epic.
Needed for the drivers that allow ADB to see the Samsung Intercept
Required to read the intercept AAA key; works as an alternative to the Android SDK.
For the Intercept. This is needed to access the Intercept’s DATA programming menu.
For the Intercept. This will get you the Intercept’s MSL/SPC number.
  • Samsung Epic 4G – Phone
This is the phone you’ll be using on Virgin Mobile.  Fascinate and other CDMA Galaxy S phones might also work with these instructions.
Epic 4G drivers for your Windows computer, needed for the device to connect via USB
Some of the Epic Programming is done here
Used to write the new MEID to the Epic 4G
Used to program the Epic 4G
Needed to get good reception and data speed on the Epic 4G.


(Optional) Before we get started, if you want MMS (Multimedia Messaging Services) for picture messaging to work you’ll need to flash your Epic 4G to CyanogenMod 7 Nightly 45 Rebuild w/ Fix [Download Link].  Or if you are running CyanogenMod 9 you can just apply this fix.

Disclaimer: Transferring a MEID/ESN between phones may or may not be legal in your region.  I cannot endorse illegal behavior but I am not a lawyer, so read up on the legal jargon yourself.  I’m also not responsible if you accidentally break your phone while trying to follow this guide.  :)

If you don’t want to transfer your MEID from your Intercept to your Epic 4G for whatever reason, this tutorial will not work for you.  Otherwise, press on.

Step 1: Get all of the data we need off of the Samsung Intercept.

From your Intercept you need 5 things. First off, your MSL/SPC.  The MSL/SPC is needed to unlock a special programming menu.  The other things you need are your AAA key, HA key, MSID number, and Directory number. The AAA key and MSID are unique and assigned by Virgin Mobile and you can’t get them anywhere except off of your own personal Samsung Intercept that is currently activated on the Virgin Mobile network.

The first thing you need to do is Install PC Studio 3 on your computer.  Download it from the link above, it’s important that you get it from the above link.

Important: Don’t plug in the Intercept before installing PC Studio 3!  Doing so may install the wrong drivers.

Now on your Intercept, connect to the Android Market via 3G (your phone should be activated on a Virgin Mobile account at this point).  Install ConnectBot and AnyCut.

Connectbot login nickname

Open Connectbot on the Intercept and click the down-arrow next to ssh and change it to local.  Type in any Nickname you want and press return.  In the next window type:

getprop ril.MSL

This is capslock sensitive!

The 6 digit number that appears is your SPC/MSL number.  Also known as your phone programming code. Write this down, you’ll need it in the next step.

Now that you have your SPC/MSL number, we can go get the HA and AAA passwords. Tap and hold an empty spot on the Intercept’s Home Screen and select to add Shortcuts. From the next list select Any Cut > Activity.  A huge list of activities will generate; scroll down to Data. There will be about 12 different Data entries, but you want the 2nd one down from the top.

Now back on the Intercept home screen click your new Data shortcut. The Data Programming interface should open up. Tap Edit, enter your 6 digit MSL/SPC number, tap Data Profile, and STOP HERE on the data profile page.

Now you need to load up ADB on the computer, and make sure the Intercept has USB debugging enabled.

Samsung Intercept Data Menu

Make sure ADB Standalone (or the Android SDK equivalent) is extracted on your computer and ready to go. Run ADB.bat from the zip and plug-in your Samsung Intercept via USB. In the ADB command window type “adb logcat” and then go back to your Samsung Intercept and tap the Username box at the top of the Data Profile window. This will make the Intercept dump a ton of information into the ADB window. Now on the Intercept Tap Cancel, do not save any changes, and back exit out of the Intercept’s Data menu.

Back in ADB, as soon as possible push Ctrl + C on your keyboard to stop logcat, the data you need is ready to read.  Right-Click the ADB window select Find…  In the find box type “aaa_pw” and your AAA key will be listed right after it. While we are in here you can also find your HA Key, which should be “vmug33k” but you can check for yourself if you like.

Find Samsung Intercept AAA Key

So now you have your Intercept’s AAA key, and the HA key. Write them down in notepad and email them to yourself. You don’t want to ever lose these. To reiterate, the AAA key is the password after aaa_pw: and the HA key should be vmug33k.  Don’t share your MEID or AAA key with anyone!

Your MSID can be found by going to Homescreen > Menu > Settings > About phone > Status. It may also be found by accessing the ##847446# menu from your dialer. Your Directory number is your real phone number, whether it was assigned by Virgin Mobile or ported through to Virgin Mobile from another carrier.

You can now disconnect the Intercept, we’re done with it.

Step 2: Write the Intercept’s MEID to the Epic 4G

Your Intercept’s MEID can be found on the back of your Intercept underneath the battery, it is also the first A00000##### part of your username from the previous step.

Note: Remember this next part!

To write it to the Epic 4G, you need to connect the Epic 4G via USB cable and then open up QPST and QXDMA. Now on the Epic 4G, open the Dialer and type ##8778# and then switch the USB mode to MODEM. Your Epic 4G will have to be literally on this screen, with USB set to MODEM, anytime you want to connect to QPST, QXDM, or CDMA DFS.

Put Epic 4G in USB Modem modeEpic 4G PhoneUTIL Modem Mode

Now go to QPST and click Add New Port… Uncheck “Show Serial and USB/QC Diagnostic ports only”. Two COM ports should show up in the box, the one you want is most likely the top one in the list. Select it and click OK.

Troubleshooting: The com ports are random numbers depending on which USB slot you have your phone cord plugged into; they probably will not be the same ports shown in the screenshot below. If the ports are not showing up properly try the following:

  • Toggle the USB mode back to PDA and then to MODEM again.
  • Exit and re-enter the ##8778# utility
  • Disconnect and reconnect the phone
  • Exit and go back into the Add New Port window
  • Uninstall and reinstall the Samsung Drivers (linked at the top of this page)
  • If you already had QPST, reinstall using the version linked above.
  • Open Task Manager and kill the ADB.exe process

connect epic4g to qpst

If you connected to the correct port your phone will be listed as FFA6550-ZRF6500.


Now go into QXDM and select Options > Communications.  Set the Target Port to the one your phone is on and click OK.

connect epic 4g to qxdm

Now type the following commands into the white Command box:

password 01F2030F5F678FF9
RequestNVItemRead meid
RequestNVItemRead ESNimage
RequestNVItemWrite meid 0x00A0000000000000 RequestNVItemRead meid
RequestNVItemRead esn
RequestNVItemWrite scm 0x3A

The first command enters the default Samsung 16 digit programming password to unlock the phone. The following two commands list your Epic’s current MEID and ESN, write them down if you want them for your own records. The third command writes the Intercept’s MEID to your Epic 4G, note that you must enter “0x00” before the actual MEID.  The rest confirm the change and set the SCM to 0x3A.

qxdm change meid

You can exit QXDM now, you shouldn’t need to use it again unless you accidentally mess up the ESN later on.

Step 3: Reprogram in QPST

Go back to QPST and select Start Clients > Service Programming.  A new window should pop-up with a phone selection screen, just click OK.

Note: You need QPST 2.7 Build 355 in order to properly program the Epic, so if it isn’t working you probably have the wrong version and need to download the one from the link above.

qpst service programming epic 4g

At the bottom left of the tool click Read from Phone.  In the pop-up that appears enter 000000 and click OK.

enter service programming code

(Optional) On this first Settings page change the Service Programming number to 000000

One tab over you’ll find the CDMA page.  In the Directory # type your actual phone number. In the IMSI_S box type your MSID number.

Enter epic DIR and MSID number

Now go straight to the M.I.P. page and use the Edit button to set profiles 0 through 2 to the following and enter the HA and AAA keys as text string (see screenshot below):

Profile 0, unchecked so it is disabled.
NAI: (e.g. A00000#######@mdata...)
NAI Tethered:
HA Shared Secret Key: vmug33k
AAA Shared Secret Key: (your aaa_pw:"*********")
Rev tun: Yes
All IP addresses to

Profile 1:
NAI: (e.g. A00000#####@mdata...)
NAI Tethered:
HA Shared Secret Key: vmug33k
AAA Shared Secret Key: (your aaa_pw:"*********")
Revn tun: Yes
All IP addresses to

Profile 2:
NAI: (e.g. A00000#####@prov...)
NAI Tethered:
HA Shared Secret Key: vmug33k
AAA Shared Secret Key: (your aaa_pw:"*********")
Rev tun: Yes
All IP addresses to

programming epic mobile ip profilesepic user profile programming

Now go to the PPP Config page. Enter data on each tab accordingly:

RM tab doesn’t let you modify anything

UM tab
User ID:
Tethered NAI:
Password: (your aaa_pw:"*********")

AN tab
User ID:
Password: (your aaa_pw:"*********")

ppp um config for epic 4g

ppp an config for epic 4g

Once you have all of the above settings put into QPST, click Write to Phone.  The Epic should restart.  Do not disconnect your cable until it has rebooted, but leave it connected anyway since you’ll need to do some more programming in DFS.

write new settings to phone

Step 4: Program the Epic 4G in CDMA DFS

Connecting your Epic 4G to the CDMA DFS Tool can be a little tricky. Open the ##8778# menu and switch USB to MODEM like we did with QPST. And, the same troubleshooting tips apply if it doesn’t work.

Open up DFS. A login screen should appear and unless you’ve donated or purchased the program you won’t be able to log in. Just click the X at the top-right and close this window to make the real program open up in demo mode.

Once in DFS, click the Ports button and then right-click the port that has your “Samsung Mobile Modem Diagnostics Serial Port…” listed and Add the port. Then exit the Port Manager and use the drop-down menu next to it to select your device. If you see just plain Samsung Mobile Modem, that is not the correct port.

connect the epic 4g to DFS CDMA

As soon as you select the correct port the screen should light up with yellow status information. Now go up the top and either enter your Epic’s SPC code 000000 in the box, or 01F2030F5F678FF9 in the password box and then click the blue > send arrow next to it.  Either one will unlock the device so you can make changes. If done correctly you’ll see a blue DEVICE UNLOCKED message in the bottom console.

unlock the epic 4g

Now go to the Programming tab, and then the Data sub-tab.  Under account settings, enter on every UID line.  On every Pwd line enter your AAA key.  Once entered, hit Write and then reboot the Epic.

epic 4g programming dataupdate epic 4g prl

The only thing left to do now is to update the PRL. Connect back up to CDMA DFS and visit the Programming > NAM tab. Under PRL click the Load button and select 01120.prl that you downloaded from the at the top. Finally, hit Write to save it to the phone and then reboot the Epic one last time.

Note: Before writing the new PRL, you may want to backup your current/old PRL in case something goes wrong. To do so click the Save button a choose a place to copy it onto your computer.

All done!  Your Epic 4G should now be working on Virgin Mobile.  No activation app or any other doo-dads required.  Feel free to drop a comment below and let us know how it went.  Or, start a help request in the free Answers community if you need assistance!


Q: Why do I need to buy and activate a Samsung Intercept on Virgin Mobile if I want to use an Epic 4G?
A: A donor phone is required in order to acquire the MEID/ESN number and AAA password key unique to your Virgin Mobile account.  A Samsung Intercept happens to be the cheapest 3G Android phone offered by Virgin Mobile, you can pick up a rough shape one on eBay for under $50. Just make sure it is marked GOOD ESN or else it is not usable on Virgin Mobile.

Q: Will I be able to use my Samsung Intercept in addition to my Epic 4G?
A: No, not as a phone, and this is in most cases illegal and considered fraud. Once you get your Epic 4G working on Virgin Mobile your Samsung Intercept will need to be powered off and stored somewhere safe.  You can theoretically take the sticker off the back and zero out the MEID/ESN and use it for a different carrier or sell it.  The Intercept cannot be used on Virgin Mobile again until you stop using the Epic 4G.  I recommend that if you have an unusable Intercept lying around you put it in Airplane Mode, zero out the MEID, MIN, and DIR, (removing all possible connectivity) and use it as an Android-powered iPod Touch via WiFi only.

Q: I can’t get my Samsung Intercept to fully connect to DFS or QPXT/QXDM, why not?
A: This is normal, the Samsung Intercept is locked down doesn’t work correctly with these programs and that is why we are using ADB, logcat, and Anycut to work around this.  You shouldn’t need to connect it for anything other than the AAA key.

Q: Can Virgin Mobile help me set up my Epic 4G to be used on their service?
A: No, and even talking to them about it will probably result in your account being suspended.

Q: Do I port my number before reprogramming my Epic 4G over?
A: Yes.  Set up a Virgin Mobile account using a Samsung Intercept (or other Android phone) and port your number from a previous carrier over to Virgin Mobile during this activation.  Your line should be working normally on your Virgin Mobile specific phone before you try moving over your Epic 4G.

Credits go out to brooksyx for the CM7 and CM9 MMS fix and to Shinydude100 for writing the first non-visual guide on XDA.  If you have an XDA account throw them a thumbs up or even a couple bucks, and if you found CDMA DFS useful feel free to throw them a dollar as well.



  1. K.G.

    Yipes – this is complex! I wish there was a service where we could just pay someone to do all the above. Excellent article though = thanks!!

    1) I am guessing it is easier, if you already have a Virgin Mobile phone?

    2) What if we just bought a unlocked Sprint EPIC 4G phone? I am assuming that the instructions would be a lot easier, if we already had a Virgin Mobile phone to go with an unlocked Sprint EPIC 4G?

    • Austin Krause

      It really isn’t too complicated once you get started. The instructions might seem long and daunting but after going through once it will probably only take you 15 minutes to repeat the process.

      1) Yeah, you need to have an ACTIVE Virgin Mobile phone already working in order to do this. It has to be a “official” Virgin Mobile phone. The Intercept is recommend because it’s the cheapest.

      2) Whether the Epic 4G is unlocked or not won’t make any difference. Just get the cheapest / best condition one you can find. The only thing that will make a difference is if the Epic 4G is flashed to use Cyanogen Mod, which has a fix to allow picture messaging on the VM network.

      • phi

        Hi I wanted to know if I can use my Vm triumph since I arleady have it. And
        I have read about the mms not working. Is there a fix for that

        • Austin Krause

          To get MMS working you need to install CM9 (flash the rom) to the Epic 4G. Then apply the fix made by brooksyx. Of course, if you know your way around the development side of the Android OS you can always apply it yourself to any other rom available.

          • Tray

            Im stuck.. I have completed all of the steps but when i try to make a call i keep getting a error 16 code and although most of the information on the phone status matches up it still says my network is sprint.. i have recieved a random txt message on my epic but cant place any calls or reply to the txts i recieved

          • MikeInCt

            I also kept getting the same error…double check your AAA pw…i went nuts for about 3 days the first time I tried this (b4 stumbling on this blog)…what I had done was, while using logcat to get the AAA, i accidentally hit a letter “R” at the end of the pw. if you think you have it correct try removing the last letter of the AAA and trying that, you may have done the same, very easy to do, if not then, try again from the start but zero out the meid first , I also had a bit of luck removing the two “00” before the A in the meid.

            0×00A0000000000000 to


            that seemed to get past the “unable to build buffer error”

            Good Luck

          • MikeInCt

            p.s. by hitting the letter by accident, it changed the aaa in the phone, disabling that one as well, and showing up in logcat incorrectly

          • Austin Krause

            For error number 16 it requires you call in to reset the line. This error code is caused by a security flag that is raised when two phones with the same MEID are attempting to connect to the network. This is why the Intercept should be kept in airplane mode and/or turned off and stored.

            To fix error 16 you need to call in to Sprint’s Error Code 16 Dept from another phone.

            The number to call is 1-877-492-9605

            Tell them you are a Virgin Mobile customer and you are receiving error code # 16. Give them your name and Virgin Mobile phone number. They will have access to this since Sprint owns and leases out Virgin mobile. If asked what type of phone you are using tell them a Samsung Intercept (or whatever phone you officially have registered with Virgin Mobile). They will reset the line and the error code should go away within a few minutes. I don’t recommend telling them anything about the Epic or bringing an unofficial phone over to the service.

            If the line is still not working, double check your Epic’s MEID in QXDM to make sure it matches the Intercepts. Then in QPST make sure the DIR and IMIS_S number match up with your real phone number and MSID. Note that the MSID should look like a real phone number, but usually not your actual phone number that people call into.

  2. Omar Garcia

    Thanks for putting this together! I bought an Epic with a blacklisted ESN from Craiglist for $60. I replaced my Optimus V, after owning an Intercept. I have a “Nexus Slider” now, due to CM9, costing me $23.75/month for service!


    1. When in the Intercept’s Data Programing, one should stop after entering the MSL. I would stop at Data Profile menu, run logcat, then tap Username–I was never able to retrieve the credentials I was looking for in the logcat summary. Only after starting logcat at the menu immediately after enting the MSL was I able to have logcat output the aaa_pw.

    2. “RequestNVItemWrite meid” should be entered in all lower-case letters: requestnvitemwrite esn

    I would get an error message regarding a buffer when entered in camel-case.

    • Adam

      I’ve been running into something similar, when I connect the intercept and run ADB logcat it dumps data, but it seems to be about the phone’s state volume info etc, never the passwords. I have used the search function and combed through the code line by line looking for what you show, and I can’t find it. I tried Omar’s suggestion of an earlier connection but no matter when I connect I still get the same dump.

      Please help.

      • Kyle

        Does any one know where to get the ancut and other android market apps needed, i cant find them! and will this work with using a Motorola Triumph as a donor for a galaxy s2?

        • Austin Krause

          It looks like Anycut was pulled out of the Android Market for some reason.

          Here’s the direct download link to the latest version of the Anycut APK I pulled off of my phone:

          Thanks for the heads up too, I went ahead and added this link as a mirror at the top of the article.

          • Silver

            working on this now austin. using epic 4g touch and an optimus v. getprop didn’t work I retrieved my MSL through cdma workshop 2.7. However Anycut which you just posted, ty, doesn’t have ‘data’ just ‘data usage’.

          • Silver

            I got the msl. I however cannot for the life of me get the AAA keys off my optimus v. I’ve tried cdma workshop but get bad parameter, I’ve tried QXDM but got error retrieving from device…

          • Austin Krause

            I don’t think the above method for finding the AAA key will work on every Android phone, just the intercept and perhaps a few others.

            “If coming from the Optimus V it is very easy to get your HA and AAA keys. First use LGNPST with the LS670 dll. Click on phone settings and read and it will get your phones data settings but will not display the passwords yet. Next disconnect the program and close it. Use DFS cdma tool next to read and ABRA CADABRA your AKEY, HA, AAA, and everything is right there on display. Also for those of you with data problems I have my three G working solid. You really need to use at least two different programs to doouble check your work. I noticed that with QPST and DFS I would get different readings on the SPI settings and the Hexidecimals for the passwords. One would say 21EF for the SPI and one program would say 8687 and yet another read 1234 to me. So I recomend downloading all the demo or buying, CDMA software that you can and reading your phone. Most important though is first scan with LGNPST IT WILL OPEN YOUR PHONE TILL REBOOT!”

          • Silver

            Austin! I did everything and i’m ported over to the touch. However It says I lost data connectivity, trying to call to voicemail gives me an error 16, I also recieve no calls. For the LAST few steps, where you put in your AAA password, can it be hex? I wrote all mine in hex and not text. I’m wondering if this is whats causing my lockout.

          • Silver

            I converted my hex passwords to text strings using an online converter. Vmugg checked out so I redid all the write stuff with text strings for HA and AAA. Phone no longer says I lost data connectivity. However still no data, voice, I get error 16 when trying voicemail and I get half a ring from calling from another phone. Before the text string fix I did not even receive the half ring. Do I have to call the support? I don’t think I screwed anything up? :(

          • Silver

            Austin, I called that number, they reset the line, it was easy as pie. I now have VOICE! and recieved a text, I sent an email as a test. However, NO DATA!!!! :( I’m still recieving this spring 131 error : data login/pass may be wrong.

          • Austin Krause

            Cool, I’m glad you got voice working!

            If Voice/SMS is working, but DATA isn’t – you have 2 possible problems.

            1. Your AAA/HA keys could be incorrect. They should be written in text string, and the HA key should be all lowercase “vmug33k.” The AAA key is cap-sensitive so it needs to be exact.

            2. You may be entering the incorrectly on the M.I..P page or the data pages. Also make sure for the 2nd profile that both the Tethered and NAI are @**prov**

          • Silver

            How many chars is the AAA key supposed to be. Could I turn off the epic and turn on the optimus v to retrieve the keys again, not sure if that is safe? I have the NV items 1192 from my optimus, typing in ALL of it except the zeros, I see my AAA password along with “the last four digits of my MEID” and at the end. I just tried writing my new AAA key’s with the last 4 digits tacked on. I retrieved my AAA key using DFS and it didn’t show the last four digits that the nv is showing. However it gave me all hex and I converted it and the HA checked out… nope… still no data even with the last 4 digits tacked onto the AAA… :( ?

          • Silver

            I sent Brook from xda a set of screenies in order. He’s going to look at it tonight. If you want an upload or an email with the same screenies, just put an email here and i’ll send it. I’ve went through everything with a fine comb brush. No data/internet :( … flashing error on the phone : Error Code 131 Sign-in failed. Your username

            and/or password may be incorrect. Please try again. If

            this problem persists, you may need to contact Sprint.

            Mobile node failed authentication

          • Jackie Simpson

            Here’s a twist, I had a Virgin Mobile Optimus v as a donor for a Sprint Galaxy S II Epic 4g Touch. Everything went perfectly and was working great on Virgin Mobile. My new job got me a Note 2 and I wanted to transfer my Cloned S II to my son’s Virgin Mobile account. I thought I’d just do the swap online, but didn’t realize that the Phone Number and MSID would not automatically transfer over. So the once working Epic Touch now needs to have the Phone # and MSID reprogrammed. The ##847446# is not working on this originally Sprint phone. The Epic’s ESN is still the same as the Optimus that was cloned. So I just need to hack in to change the 2 numbers. Any suggestions?

  3. Omar Garcia

    3. The drivers in the Modified PC Studio 3 didn’t allow me to connect the Intercept to ADB. One must use the modem drivers found in the Samsung support site for the Intercept.

  4. gadget

    All the links to get:
    •Modified PC Studio 3
    •ADB Standalone
    •QPST Build 355
    it says each of these does not exist anymore?

    Samsung Drivers I can’t seem to click the correct link to actually download them?

    The page does not exist anymore, so is it the same as the free download, because it doesn’t show the phone?

    • Austin Krause

      Updated all of the links, let me know if there’s anything else!

  5. James

    Hey! Just wanted to let you know this is 99% similar for the Epic Touch 4g from Sprint also

    • Raymond

      Hi james. I just tried this on my 4g touch. I thought everything went well, but still no service. Do you know what has to be done different for the 4g touch?


      • Austin Krause

        I can confirm this works with the Epic Touch. I didn’t really notice any differences in what needs to be done actually.

        If you aren’t getting service, go into QPST and make sure that you enter in the MDIR number first, and the MSID second. Also check with QXDM and make sure you are using the intercept’s MEID (ESN)

        • Baruch Noy

          Hi, I am also having trouble doing this on an Epic Touch. I can confirm that all of the details above are correct, including MEID, MDIR, and MSID, but there is an Error 67 message about wrong sprint username and password. I think it has to do with APN settings, but I have not found a way to edit APN settings and save them (even through anycut). Any ideas? Thanks!

          • cdogg

            anyone get the epic touch to work without the error 67. im pulling my hair out here. thanks

  6. Joe

    This guide helped a lot for my HTC Wildfire S with a bad ESN. Only thing is it was already a Virgin Mobile phone. Getting data to work was easy, but calls and texts don’t work. So I’ll have to look into that. Unless someone here knows how to do it with a VM Wildfire S.

    Great guide though. Really helpful.

    • insink71

      I do not know how to use WFS as doner… been experimenting.. The only part I have trouble with is getting the AAA key. If you’d like to reset your Virgin Mobile WFS; though, Football has posted the RUUs I purchased from him for the 3 marvelc carriers [choose the one that says marvelc sprint in lieu of the one that may be marvel virgin mobile [[canadian, gsm]]] Check out his thread stickied first in development XDA for aforementioned device. Run that on your windows machine with phone attached via usb cable and it will reset your data, mms, all that good stuff. However you do want to have the correct ESN in your phone first [not a bad one :( ]. Check out team marvelusc’s thread [also in dev on xda, wildfire s] and I’ll be back from my sabbatical in about a month… hopefully I can tell you at that time how to get your aaa key if you’re interested in playing with other devices [that you own]; still trying to get that right myself.

      • Joe

        I actually found the problem, after I wrote the MEID with DFS CDMA Tool, It generated a pESN in an un-editable box below it, all I had to do was use a hex editor on file ‘0’ after doing the ‘open sesame door’ using EFS File explorer, and rewrite the ESN to the pESN. Which is how I had to re-write the MEID also. So I just extracted the files ‘0’ and ‘1496’ rewrote them in a hex editor so they would read all 0’s and deleted/replaced them. Rebooted the phone, wrote the MEID. Rebooted again, and rewrote the ‘0’ file with a hex editor since the ESN did not want to change in DFS. Made it way more complicated than it should have been.

        • insink71

          interesting to note ‘open sesame door’ works with Wildfire S. Now maybe I can finish reading the nv items that first gave me access denied msging. Thanks for the info. I recently screwed a M.IP setting so I’m hunting the aaa like mad ;)
          Tip: don’t do ##3282#, Edit, miskey, then hit revert.. it doesn’t revert, it deletes :/


  7. Tristan

    hmm i followed all the instructions and the 3g isn’t working i found my AAA code and did everything and ran into no problems until then end i get error code 67 Registration failure.

    under Mobile netweok state it says connecting but it doesn’t seem to be doing anything..have any suggestions

    • Joe

      You messed something up in either the M.IP tab or the PPP tab. Recheck it and check all the check boxes that are shown in pictures and all that.

      • Tristan

        i got it working thanks for the great tutorial. I’m curious i’m now trying to get some of the built in sprint apps to work like sprint T.V, mobile hotspot, and usb tethering but i’m rejected out of those programs do you know of a way to use them

        • Phillip F.

          Which Rom are you using? With Glean GB the wifi hotspot works perfectly.

          • Tristan

            erm…well i haven’t rooted the phone it looked abit more challenging and riskier than just flashing the phone to virgin…i mean i’l do that if necessary

            I have gingerbread El30

  8. Shaun

    will this work for other sprint phones

  9. Adam

    I can’t get my logcat to show the aaa password. Search for aaa reveals nothing, seems to be dumping data about the audio system… why would it do that? I have both used the search function and gone through the lines one by one. Any ideas?

  10. Charlie

    I have gone through all the steps and can only get voice/ text to work. I’ve checked all the setting throughly and can not get DATA working to any degree. PLEASE help…

  11. weinerwad3000

    The ADB file I download is empty. Any other links?

  12. weinerwad3000

    Found a good ADB file but now it just says waiting for device. It never dumps any info. I tried the suggestion from Omar Garcia but to no avail.

  13. Scott

    Why is it necessary to write the profile in DFS and QPST? I’m reprogramming a nexus s 4g onto ting and I get 1x data, but can’t seem to get 3g working. Just wondering if you knew what the differences were – I may try to do that, to see if that fixes my issue. My donor phone doesn’t have most of those settings set in QPST though, so I hadn’t tried that yet.

    Thanks for the in depth guide!!

  14. Jack

    This is similar to using a wildfire s, but only if you dump radio and then peice through it in hex looking for the word “secret” also you must use open sesame door hack

  15. MikeInCt

    Absolutely perfect tutorial…Im all set up..and if you use google voice you can use the $35 unlimited plan for UNLIMITED EVERYTHING Talk/Text/MMS?Data/GPS TV the whole 9…thanks alot….and on a side note…if done this way correctly…you actually have 2 working phones on the same plan and it doesnt interfeer which i found weird….that being said!!!!!! again if using Goofgle voice services you can have 2 sepwerate numbers sharing the same $35 dolar plan!!! ME LIKEY ALOT….thanks again Sir…and everyone involved in this

    • Austin Krause

      Make sure you don’t use both phones on the same line, that could get you in serious legal trouble. (I’m not a lawyer though, so it’s up to you)

      • MikeInCt

        you’re absolutely right…i meant to amend my post there.. definitely some negative legal implications here. .and it doesnt actually work as i thought it would anyways, the phones were next to each other, so they would ring together, however if they are on different towers then one would receive the call and not the other, and i could definitely see you getting in trouble if you were to make simultaneous calls from both phones. i think that if you were to disable calls in the intercept and have it as data only with Google, that may go undetected and work correctly. Be careful people and good luck.

  16. Rob

    Thanks so much for the tutorial, everything went like a breeze but I seem to have one issue. I am running cm9 beta 2 and haven’t been able to get gps signal at all? When converting the epic to virgin mobile do I lose the gps function or is it a problem in cm9 you think?

    • Austin Krause

      GPS should still work. I’ve had it working, but it seems slow. On stock it works fine, so it must be a CM9 issue.

  17. MikeInCt

    @Austin can we hook up in a private mesage…i messed something up and ive gone throught everything about 5 times now and can find what i did wrong…i can give you screenshts of everything and whatever info you want. I had it working perfectly the first time and im not sure how or what I did but i have data working but i cannot make a call…says error 16 ( i believe its a sprint code)when i make a call…and incoming gives me a half of a ring and hangs up…im lost…

    • MikeInCt

      btw…my intercept works perfectly still…and from what i can see the settings that matter are identical throughout…unless im just not seeing it…idk

    • MikeInCt

      Well…im am admittedly a jackass!!!!…apparently when i was scanning for my aaA_pw i must have hit the r button when hitting ok on the intercept….so the r was messing everything up….i lost data on ly intercept so i figured it was something i did…went back in deleted the r and restored everything….once again thanks for the info and support on here

  18. jmz

    So I used wildfire s as a donor phone. and evo as the recieving. Got everything working except outgoing text. I get error 97. Every rom, AOSP or Sense. If I pull battery on evo and turn on wildfire s then i can send text on wildfire s. So 90% sure it is a provisioning issue. Any ideas?

  19. Chris

    So, I followed this exactly to a T with my Shift that I’m putting on virgin mobile, and I can’t get 3G/Data working. Error 67. I have no idea what I’m doing wrong. Any thoughts or suggestions, anyone?

  20. tckrwldn

    Can you use any virgin mobile phone? I have the Rumor Touch and want to switch to the fascinate.

  21. rayray

    Hi, I saw a question about a VM Triumph to Epic 4G, but did not understand the reply. Is it possible to go from the Triumph to the Epic 4G? And more importantly will the steps be different from the ones in the post b/c it’s a different donor phone?

  22. David

    Hey everyone, appreciate all the great info. I have done all these steps with my sprint phone and I have voice and text working but getting the error 67 with the date. I’ve gone through it time and time again but nothing seems to be working. Any help would be great.

    Thanks so much,


  23. David

    error 67 with data (sorry for the spelling on last post)


  24. josh

    hey can you post a link to revert a flashed epic back to stock. i have a pageplus sprint with a clear esn and i cant enable hands free activation even after changing the prl back to sprint

  25. pedro

    does the optimus work as a donor phone

    • Austin Krause


  26. jose

    does the donor phone need to be a android

    • Austin Krause

      No, you can use any 3G data phone. But, depending on the model it will be much more difficult and you may receive lower speeds/data caps.

      • jose

        how do i do it with the samsung restore

  27. chris

    interested to see how the new 4g network works with these phones. are you able to upgrade to 4g from 3g during the transition if the new phone has 4g capability?

    • Austin Krause

      You’ll need to use a Virgin Mobile 4G donor phone if you want 4G to work on the Epic 4G. This will also require the extra step of getting the wiMax information from the donor phone and also programming that.

  28. dude

    Hi i have optimus v and did this Open Connectbot on the Intercept and click the down-arrow next to ssh and change it to local. Type in any Nickname you want and press return. In the next window type: getprop ril.MSL then done
    well i get $ no 6 digit code
    will i need different program?
    thank you

  29. jonathan

    Has this same process been tried on any other phones besides the Samsung Epic 4G?

  30. Rona Maturi

    hi i made it all the way to the part where i write meid
    RequestNVItemWrite meid 0×00A(myMEIDhere)

    and i get
    RequestNVItemWrite meid 0×00A000002891998B

    • Rona Maturi

      WOW… i figured it out… make sure the X is capital not lower case x LOL

      • bjc

        Thanks Bro! That was killin me too!

  31. Rona Maturi

    oh yea this is an Epic 4 g touch galaxy SII

    • raymond

      Hi, were you able to do this on an epic 4g touch? I tried doing it today, but when I was done no service on my epic 4g touch. Any ideas? any thing different from this tutorial b/c its a 4g touch?
      any help would be great!

  32. HopeIHelp

    Worked great for me except for a few hangups:
    1. ADB link is empty, I had to download elsewhere.
    2. I had to install Android SDK and then the Android drivers from within it because PC Studio was just not recognizing my Intercept with its USB drivers.
    3. QPST would not see or connect to my phone with CM9 when going into phoneutil with *#*#8778#*#* and enabling modem. To fix this I booted Samsung’s firmware off of the memory card. From there I put in ##8778# and then the modem option worked.

    4. When writing the new MEID I had to put a capital X just like someone else mentioned.

    • Steve Krause


  33. jon

    On Anycut, I can’t find any settings for data. I just get data usage and date and time. How do i fix this?

  34. hopethishelps

    My data was working but not texts or calls. The MSID should not have two zeros in front of it. When I got got the MSID from my Intercept it had two zeros and I copied and pasted the value in without realizing I was short by two numbers.

  35. Ryan Whitman

    Ive previously flashed an Evo 3D to Virgin using an LG Optimus V, but ive followed these steps exactly, and have done them several times and im still getting error 67 on my Epic Touch 4g. Is there any differences between the GS and the GS2 that would affect the process?

    • Baruch Noy

      Hi, how did you fix this? Were there real question marks, or something else that we should take off for the epic touch? I am having the same issue. Thanks!

      • Austin Krause

        The AAA shouldn’t have a set of ? marks, although it can contain one, and other symbols. Mine had a exclamation mark (!) in it.

        The set of ???’s will work on some phones, but not with the Galaxy S series. This means if your donor phone has ???’s, remove them when entering the key on the Epic.

  36. Anthony

    I get data but my texting and calls dont go through. How do I fix this?

  37. dorian

    how do yo fix the error 16 on 4g touch when you make a call

  38. Rick Stephens

    Can you do this if you have a Blackberry and want to move it too the Epic 4g? Does the original phone have to be Android? Thanks

    • Matthew Anderson

      this guide will not work for Blackberry. If you can get the required information off your blackberry you could get this working, but the programs he has listed will only work to get the MEID from an Android phone.

  39. Angelo

    will i be able to use the 4g now that VM has it?

    • Austin Krause

      Only if you purchase a Virgin Mobile Evo 4G and use that as your donor phone. At that point it is then an additional step not covered here to reprogram the WiMax settings to match up with Virgin Mobile’s.

      The downside to that is, the Evo is $239.

      • Angelo

        thanks a ton

      • vast8fm

        Is there a way to take a sprint EVO 4G and flash it to Virgin Mobile service? What do I need?

  40. Σ Guy in FL

    I’ve tried 3 times now. No luck. Followed the guide to the letter (and picture). I’m on CM9 so I used HopeIHelp’s advice and did the multiboot. Modem connected then and got the meid and ESN correct (exact same Hex as the Intercept), but even re-doing ALL of the steps 3 times I can get 3G data, but, “Your account cannot be validated. Please call Customer Support.” anytime I try to make a call (no text as well, I have applied the fix [new and old], still no luck). Every time I reload QPST and DFS, the aaa_key doesn’t show up, and things are changing when I do the Read function (without changes) from DFS after trying to make a phone call. PRL is updated to 01120, I’ve tried this 4 times now (just tried again while I was doing this message) and still same result. “Your account cannot be validated.” What am I doing wrong? I have literally followed this guide word for word 4 times. No success. CM9 Stable ROM, used multiboot utility for CM9 to get port comms to work, and QPST and DFS configuration was 100% accurate according to this guide.
    Something I noticed though, my aaa key is 10 digits long…. is this correct? What are the amount of digits in the aaa key (or is it different for everyone). Followed the logcat directions, after the 3rd time of getting the same aaa key I’m 99% sure that I have the right one.
    Steps I’ve taken
    1) QXDM ESN/meid change – success
    2) QPST Config – fail, changes do not “stick”
    3) DFS Config – fail, changes do not “stick”
    For example, boot to recovery, reboot from multiboot. Change QPST config, write, reboot automatic. Boot to recovery, reboot from multiboot. into DFS, DFS Config changes, write, reboot manually. Reboot to my normal CM9, make a call…. “Account not validated.” Reload QPST and DFS, do “Read”… settings are not what I had typed in. !?!?! o_O
    I’ve never asked for help when it comes to these type of matters…. but this is over my head. I’m about to flash to stock, and then reflash CM9 (….. sigh…. fml). Anybody think they can help?

    • Austin Krause

      My experience with CM9 resulted in my flashing to stock, getting everything working, and then flashing to CM9 again. All of the modem programming should persist through the ROM flash, so once you have it working it will be working for good.

      I did this with both the Epic and Epic S2 (Touch)

      • Σ Guy in FL

        It worked! Thank you so much! I did go to the rooted Stock ROM, restored back to CM9 after I figured out my whole problem was the MSN and MSID were reversed (how the hell did that happen!?), I screwed up somewhere lmao. But thank you! I love ROM backups lol. Especially since the hardware programming is seperate. Just wish I could get 4G, wish I knew that before I got the phone. However, the phone came with a month already so I guess I lucked out. :P Thank you guys again! Awesome!! Can’t believe I have my Epic working for $35/month. I’m about to go to the $45 a month for more minutes…. yeah!

  41. Aaron

    How did you get the stuff of your optimus v? Please email me if you remember how to do this. Thanks

  42. tdm

    SPC can be read using cdmaworkshop. AAA key must be read by first doing an NV read through LGNPST (this unlocks something), then reading with another program.

  43. Brad

    I cant get my Samsung Intercept to connect to my PC. It’s a driver issue but I can’t find any drivers that will work with a 64 bit version of Windows 7. Both of my PCs are 64 bit Windows 7 machines. Any idea how to work around this?

  44. Brad

    Might want to add to this if someone is having troubles with the intercept and windows, a work around would be using alogcat from the android market and just doing it on your phone. that’s how I was forced to do it to get my aaa pw.

  45. Donald Beauchamp

    Ok, im having a problem with step 3 not saving the info im putting in as directed.
    Im thinking is because ps studio is not connecting to my phone. I can get all other programs to see my phone except pc studio. what effect if any does studio have and how do i get it to connect? tried everything mentioned in these posts and other sites. when i go back into step 3 its showing some boxes saved and some it putting sprint stuff back in.

  46. r2d2

    Is it possible to use this same method with an HTC Evo 4g and an HTC One V donor? Or is this all specific to samsung handsets?

  47. isai

    how do I get ha keys and aaa keys???

    • Austin Krause

      Just follow the guide above!

  48. d knight22

    Hey I was just wondering if doing this the same way for Sprint nexus s 4g to virgin mobile I havea triumph as a donor please help

  49. Anthony

    I’m trying this with the galaxy s3 and I can’t get qxdm to write the meid/esn.

  50. Isaac

    i have seen a lot of Error 67 (No Data / Internet) , have any of you guys have a fix for this?
    everything works (Calls and Text ) but Data / Internet…

  51. bloo

    on connectbot when i enter getprop ril.MSL no 6 digit number appears any help? D: also i m using the htc evo 3d and would want the 4g too help?

  52. David S

    Will this process potentially work for a Verizon iPhone?

    • Austin Krause

      Honestly I have no idea what software one would use to reprogram the modem on an iPhone.

      I imagine it would need to be jailbroken.

      It theoretically is possible though, given that the Verizon iPhone is CDMA just like Virgin Mobile (Sprint).

  53. KJ

    Thanks for the excellent article! I’ve now got my old Epic 4g on my Virgin Mobile account working perfectly and with CM10.1 – much better then my old LG Optimus Elite!

    I did run into issues installing QXDM in Windows 8. When I tried to install it I got an error where it was testing for a version of IE > 6, but apparently 10 doesn’t count. I tried compatibility mode but only have Previous Windows version available when it appears that you really need XP. This might be a limitation of 8 Home but is good to note. I still needed compatibility mode in Windows 7 to install, but that worked without issue.

    Thanks again!

    • Austin Krause

      Awesome! Thanks for the feedback. I’m glad it worked for you!

      Interesting that Windows 7 required compatibility mode for QXDM though, I never saw that issue. Could be related to the edition of windows (Ultimate vs. Home, etc)

  54. Pablo C

    How many characters is the AAA key (Samsung Intercept), also can i get the ha/aaa passwords on a deactivated phone?

    • Austin Krause

      AAA key should be 9 characters/symbols long.

      Yes you can retrieve them from a deactivated phone.
      BUT the phone must be active on the account or else the AAA key will not work. If the you try the use an AAA key from a deactivated phone Virgin Mobile will reject the connection and no service will go through.

      • Pablo C

        thanks for your response.

        I was trying to get my ha/aaa password from a deactivated Samsung intercept, this an example of what i got “aaa_pw:w9l+olO6z4”, btw im only using alogcat adb didn’t recognize my intercept.

        I should get a similar result once the intercept its been activated right?, I guess I have to skip the + symbol.

  55. Austin Krause

    No, the + symbol is part of the AAA key. Do NOT skip it.

    There is a chance that when the phone is activated that Virgin Mobile will reprogram it and issue a new AAA key, so trying to pull it now might be a waste of time.

    I recommend:

    1. Activate the phone.
    2. Make sure it works.
    3. Then follow this guide and copy the keys over to your non-virgin mobile phone.

    • Pablo C

      ok I’m going to activate the phone under my account, but you said the aaa password should be 9 characters long and what I’m getting now is 10 characters long password.

      • Austin Krause

        It’s very possible that the AAA key could have more characters, give it a shot!

        Good luck Pablo, report back if you have problems.

  56. corey wilson

    does the virgin mobile phone that im using (htc evo v) have to be in service meaning bill payed? and also does the epic 4g touch have to be rooted?

  57. Dan Allain

    Hey there im interested in doing this to my et4g and im currently using a native phone from Vmobile (evoV3d4g) and i have a couple of questions.

    1.Can i use my sprints ept4g?

    2.Can i use 4g if i succeed in flashing it to vmobile since my evo3d is running native 4g?

    3.If 4g wont work on my et4g can i just turn it off and turn on my evo3d4g and use 4g service there?

    Thank you very much

    • Austin Krause

      Yes, Sprint’s phones actually work best for this since Virgin Mobile uses Sprint towers.

      If you already have 4G active on Virgin Mobile, then you just need to transfer the WiMax keys over to the ept4g. I don’t have the instructions for doing so, so you’ll have to Google it because the 4G modem is completely separate from the 3G/voice/text one in this article.

      You can’t use both phones at the same time. If the carrier detects dupliacate cell keys connecting to 3G/voice/text it will issue a block on your duped phone and result in an error #16. The problem with your idea is that in order for the evo3d to connect to 4G it must first be able to find the towers over 3G/voice/text. Of course if you put one phone in airplane mode it won’t connect to 3G/voice/text and you can use it just fine, even over Wi-Fi. I don’t think 4G works while in airplane mode, but please correct me if I’m wrong. If 4G does work while the phone is in airplane mode then you certainly could do this, otherwise no.

  58. Christian Jung

    Can I port over any phone and does it have to be sprint?
    Also will the lg Optimus v work to steal its things.

    • Austin Ruthruff

      Any phone that is CDMA should work.

  59. Ricky

    I have followed this guide step-by-step on my epic touch. Everything works except data. I’ve double checked everything. I’m not getting any username/password errors for data theres just no 3g indicator in my status bar. I know I’m entering everything correctly. I can call/text but no data. I appreciate the guide!!!

  60. Jeremy

    Hey, so I have gotten down to the step with DFS. I cannot for the life of me get it to recognize my Epic 4g as the Samsung Mobile Modem Diagnostic Serial Port. It just says Samsung Mobile Modem. I was able to connect to QPST and QXDM just fine using the recovery “boot from SD card” trick. The same way I got into QPST does not work for DFS. Any advice? I am on the last step! Thank you

  61. David

    Hi, I have an LG Optimus G from Sprint. I have one flashed to PagePlus but I have another one I want to try on Virgin. This phone is a real pain in the butt to transfer over the 3g (10key) so I was wondering if you know of a full proof way. I can get a Samsung Intercept for $25 off of Ebay so its no big loss. The LG is one of those LTE phones and from my understanding thats why its hard to port over the 3g keys. Would using an LG Optimus V be a better choice for a donor? Please Email me if you can.

  62. tabby2013

    Thanks for the great guide! I have had no problems so far in implementing the instructions. I did run into the error code 16 but got it resolved with the instructions you provided.So far calls out, calls in, texting, internet all are working fine. I am happy enough with stock since bloat ware has been removed. My question is whether using a STOCK rooted rom will cause any problems in coming days? Thanks for helping keep a great phone useful and saving just a little of the planet!

    • tabby2013

      Just a follow up, all has continued working just fine. I’ve had no problems using rooted, stock rom with the bloat ware removed. I don’t use MMS so I’m not sure if there is an issue there, I text, email, surf, play games and use the phone as a phone. All is good.

  63. Mal

    I can not download the QXDM. I keep getting an error message saying that I need internet Explorer 6.0 or higher. I have the most updated internet explorer. IE 10. Please help
    thank you

    • Mal

      never mind
      I found a download link that works with windows 7.

      • Don W.

        Having the same issue with QXDM. Where did you find the link?

  64. Jessica

    I have a virgin mobile LG Optimus Elite and I’m wanting to switch over to my Samsung Fascinate. Will this work if I follow the steps provided?

  65. Don W.

    Has anyone tried this with a Kyocera Event from Virgin Mobile? I am trying to use the Event as a donor phone for my Samsung Galaxy S2 (formerly Sprint). Everyone seems to be saying they have asterisks in the AAA/HA password fields when in the ##DATA# menu. However, mine is blank. Tried getting this from ADB logcat, however, no luck. Yes, it is activated. Am I doing something wrong? I am out of ideas. Any help would be great! Thanks!

    • Don W.

      Still can’t seem to get the AAA or HA passwords off of my Kyocera Event. Anyone have any ideas? Is Kyocera just more of a pain? Thanks.

  66. SYM

    I have a VM “dumbphone” with no data. (LG 200). Obviously, I can get the ESN. Can I write that to a Sprint phone (TP2, EVO 4G) and get talk/text without data? (Which is exactly what I have now)

To Top