I’ve recently learned some basic phone modem programming knowledge and thought I would share. The guide below will cover the basic requirements for getting an Epic 4G to run on Virgin Mobile with full Voice, SMS, and 3G Data coverage.
Scavenger Hunt Time, here are the tools you’ll need before we get started:
|Item:||Why you need it:|
|This is the donor phone you need to activate Virgin Mobile service on. You’ll have to have its MSID, MEID, HA key and AAA key to get service on your Epic.|
|Needed for the drivers that allow ADB to see the Samsung Intercept|
|Required to read the intercept AAA key; works as an alternative to the Android SDK.|
|For the Intercept. This is needed to access the Intercept’s DATA programming menu.|
|For the Intercept. This will get you the Intercept’s MSL/SPC number.|
|This is the phone you’ll be using on Virgin Mobile. Fascinate and other CDMA Galaxy S phones might also work with these instructions.|
|Epic 4G drivers for your Windows computer, needed for the device to connect via USB|
|Some of the Epic Programming is done here|
|Used to write the new MEID to the Epic 4G|
|Used to program the Epic 4G|
|Needed to get good reception and data speed on the Epic 4G.|
(Optional) Before we get started, if you want MMS (Multimedia Messaging Services) for picture messaging to work you’ll need to flash your Epic 4G to CyanogenMod 7 Nightly 45 Rebuild w/ Fix [Download Link]. Or if you are running CyanogenMod 9 you can just apply this fix.
Disclaimer: Transferring a MEID/ESN between phones may or may not be legal in your region. I cannot endorse illegal behavior but I am not a lawyer, so read up on the legal jargon yourself. I’m also not responsible if you accidentally break your phone while trying to follow this guide. :)
If you don’t want to transfer your MEID from your Intercept to your Epic 4G for whatever reason, this tutorial will not work for you. Otherwise, press on.
Step 1: Get all of the data we need off of the Samsung Intercept.
From your Intercept you need 5 things. First off, your MSL/SPC. The MSL/SPC is needed to unlock a special programming menu. The other things you need are your AAA key, HA key, MSID number, and Directory number. The AAA key and MSID are unique and assigned by Virgin Mobile and you can’t get them anywhere except off of your own personal Samsung Intercept that is currently activated on the Virgin Mobile network.
The first thing you need to do is Install PC Studio 3 on your computer. Download it from the link above, it’s important that you get it from the above link.
Important: Don’t plug in the Intercept before installing PC Studio 3! Doing so may install the wrong drivers.
Now on your Intercept, connect to the Android Market via 3G (your phone should be activated on a Virgin Mobile account at this point). Install ConnectBot and AnyCut.
Open Connectbot on the Intercept and click the down-arrow next to ssh and change it to local. Type in any Nickname you want and press return. In the next window type:
This is capslock sensitive!
The 6 digit number that appears is your SPC/MSL number. Also known as your phone programming code. Write this down, you’ll need it in the next step.
Now that you have your SPC/MSL number, we can go get the HA and AAA passwords. Tap and hold an empty spot on the Intercept’s Home Screen and select to add Shortcuts. From the next list select Any Cut > Activity. A huge list of activities will generate; scroll down to Data. There will be about 12 different Data entries, but you want the 2nd one down from the top.
Now back on the Intercept home screen click your new Data shortcut. The Data Programming interface should open up. Tap Edit, enter your 6 digit MSL/SPC number, tap Data Profile, and STOP HERE on the data profile page.
Now you need to load up ADB on the computer, and make sure the Intercept has USB debugging enabled.
Make sure ADB Standalone (or the Android SDK equivalent) is extracted on your computer and ready to go. Run ADB.bat from the zip and plug-in your Samsung Intercept via USB. In the ADB command window type “adb logcat” and then go back to your Samsung Intercept and tap the Username box at the top of the Data Profile window. This will make the Intercept dump a ton of information into the ADB window. Now on the Intercept Tap Cancel, do not save any changes, and back exit out of the Intercept’s Data menu.
Back in ADB, as soon as possible push Ctrl + C on your keyboard to stop logcat, the data you need is ready to read. Right-Click the ADB window select Find… In the find box type “aaa_pw” and your AAA key will be listed right after it. While we are in here you can also find your HA Key, which should be “vmug33k” but you can check for yourself if you like.
So now you have your Intercept’s AAA key, and the HA key. Write them down in notepad and email them to yourself. You don’t want to ever lose these. To reiterate, the AAA key is the password after aaa_pw: and the HA key should be vmug33k. Don’t share your MEID or AAA key with anyone!
Your MSID can be found by going to Homescreen > Menu > Settings > About phone > Status. It may also be found by accessing the ##847446# menu from your dialer. Your Directory number is your real phone number, whether it was assigned by Virgin Mobile or ported through to Virgin Mobile from another carrier.
You can now disconnect the Intercept, we’re done with it.
Step 2: Write the Intercept’s MEID to the Epic 4G
Your Intercept’s MEID can be found on the back of your Intercept underneath the battery, it is also the first A00000##### part of your @mdata.vmobl.com username from the previous step.
Note: Remember this next part!
To write it to the Epic 4G, you need to connect the Epic 4G via USB cable and then open up QPST and QXDMA. Now on the Epic 4G, open the Dialer and type ##8778# and then switch the USB mode to MODEM. Your Epic 4G will have to be literally on this screen, with USB set to MODEM, anytime you want to connect to QPST, QXDM, or CDMA DFS.
Now go to QPST and click Add New Port… Uncheck “Show Serial and USB/QC Diagnostic ports only”. Two COM ports should show up in the box, the one you want is most likely the top one in the list. Select it and click OK.
Troubleshooting: The com ports are random numbers depending on which USB slot you have your phone cord plugged into; they probably will not be the same ports shown in the screenshot below. If the ports are not showing up properly try the following:
- Toggle the USB mode back to PDA and then to MODEM again.
- Exit and re-enter the ##8778# utility
- Disconnect and reconnect the phone
- Exit and go back into the Add New Port window
- Uninstall and reinstall the Samsung Drivers (linked at the top of this page)
- If you already had QPST, reinstall using the version linked above.
- Open Task Manager and kill the ADB.exe process
If you connected to the correct port your phone will be listed as FFA6550-ZRF6500.
Now go into QXDM and select Options > Communications. Set the Target Port to the one your phone is on and click OK.
Now type the following commands into the white Command box:
password 01F2030F5F678FF9 RequestNVItemRead meid RequestNVItemRead ESN RequestNVItemWrite meid 0x00A0000000000000 RequestNVItemRead meid RequestNVItemRead esn RequestNVItemWrite scm 0x3A
The first command enters the default Samsung 16 digit programming password to unlock the phone. The following two commands list your Epic’s current MEID and ESN, write them down if you want them for your own records. The third command writes the Intercept’s MEID to your Epic 4G, note that you must enter “0x00” before the actual MEID. The rest confirm the change and set the SCM to 0x3A.
You can exit QXDM now, you shouldn’t need to use it again unless you accidentally mess up the ESN later on.
Step 3: Reprogram in QPST
Go back to QPST and select Start Clients > Service Programming. A new window should pop-up with a phone selection screen, just click OK.
Note: You need QPST 2.7 Build 355 in order to properly program the Epic, so if it isn’t working you probably have the wrong version and need to download the one from the link above.
At the bottom left of the tool click Read from Phone. In the pop-up that appears enter 000000 and click OK.
(Optional) On this first Settings page change the Service Programming number to 000000
One tab over you’ll find the CDMA page. In the Directory # type your actual phone number. In the IMSI_S box type your MSID number.
Now go straight to the M.I.P. page and use the Edit button to set profiles 0 through 2 to the following and enter the HA and AAA keys as text string (see screenshot below):
Profile 0, unchecked so it is disabled. NAI: yourMEIDemail@example.com (e.g. A00000#######@mdata...) NAI Tethered: yourMEIDfirstname.lastname@example.org HA Shared Secret Key: vmug33k AAA Shared Secret Key: (your aaa_pw:"*********") Rev tun: Yes MN-HA SPI: 21EF MN-AAA SPI: 21EF All IP addresses to 0.0.0.0 Profile 1: NAI: yourMEIDemail@example.com (e.g. A00000#####@mdata...) NAI Tethered: yourMEIDfirstname.lastname@example.org HA Shared Secret Key: vmug33k AAA Shared Secret Key: (your aaa_pw:"*********") Revn tun: Yes MN-HA SPI: 21EF MN-AAA SPI: 21EF All IP addresses to 0.0.0.0 Profile 2: NAI: yourMEIDemail@example.com (e.g. A00000#####@prov...) NAI Tethered: yourMEIDfirstname.lastname@example.org HA Shared Secret Key: vmug33k AAA Shared Secret Key: (your aaa_pw:"*********") Rev tun: Yes MN-HA SPI: 21EF MN-AAA SPI: 21EF All IP addresses to 0.0.0.0
Now go to the PPP Config page. Enter data on each tab accordingly:
RM tab doesn’t let you modify anything
UM tab User ID: yourMEIDemail@example.com Tethered NAI: yourMEIDfirstname.lastname@example.org Password: (your aaa_pw:"*********") AN tab User ID: yourMEIDemail@example.com Password: (your aaa_pw:"*********")
Once you have all of the above settings put into QPST, click Write to Phone. The Epic should restart. Do not disconnect your cable until it has rebooted, but leave it connected anyway since you’ll need to do some more programming in DFS.
Step 4: Program the Epic 4G in CDMA DFS
Connecting your Epic 4G to the CDMA DFS Tool can be a little tricky. Open the ##8778# menu and switch USB to MODEM like we did with QPST. And, the same troubleshooting tips apply if it doesn’t work.
Open up DFS. A login screen should appear and unless you’ve donated or purchased the program you won’t be able to log in. Just click the X at the top-right and close this window to make the real program open up in demo mode.
Once in DFS, click the Ports button and then right-click the port that has your “Samsung Mobile Modem Diagnostics Serial Port…” listed and Add the port. Then exit the Port Manager and use the drop-down menu next to it to select your device. If you see just plain Samsung Mobile Modem, that is not the correct port.
As soon as you select the correct port the screen should light up with yellow status information. Now go up the top and either enter your Epic’s SPC code 000000 in the box, or 01F2030F5F678FF9 in the password box and then click the blue > send arrow next to it. Either one will unlock the device so you can make changes. If done correctly you’ll see a blue DEVICE UNLOCKED message in the bottom console.
Now go to the Programming tab, and then the Data sub-tab. Under account settings, enter yourMEIDfirstname.lastname@example.org on every UID line. On every Pwd line enter your AAA key. Once entered, hit Write and then reboot the Epic.
The only thing left to do now is to update the PRL. Connect back up to CDMA DFS and visit the Programming > NAM tab. Under PRL click the Load button and select 01120.prl that you downloaded from the at the top. Finally, hit Write to save it to the phone and then reboot the Epic one last time.
Note: Before writing the new PRL, you may want to backup your current/old PRL in case something goes wrong. To do so click the Save button a choose a place to copy it onto your computer.
All done! Your Epic 4G should now be working on Virgin Mobile. No activation app or any other doo-dads required. Feel free to drop a comment below and let us know how it went. Or, start a help request in the free Answers community if you need assistance!
Q: Why do I need to buy and activate a Samsung Intercept on Virgin Mobile if I want to use an Epic 4G?
A: A donor phone is required in order to acquire the MEID/ESN number and AAA password key unique to your Virgin Mobile account. A Samsung Intercept happens to be the cheapest 3G Android phone offered by Virgin Mobile, you can pick up a rough shape one on eBay for under $50. Just make sure it is marked GOOD ESN or else it is not usable on Virgin Mobile.
Q: Will I be able to use my Samsung Intercept in addition to my Epic 4G?
A: No, not as a phone, and this is in most cases illegal and considered fraud. Once you get your Epic 4G working on Virgin Mobile your Samsung Intercept will need to be powered off and stored somewhere safe. You can theoretically take the sticker off the back and zero out the MEID/ESN and use it for a different carrier or sell it. The Intercept cannot be used on Virgin Mobile again until you stop using the Epic 4G. I recommend that if you have an unusable Intercept lying around you put it in Airplane Mode, zero out the MEID, MIN, and DIR, (removing all possible connectivity) and use it as an Android-powered iPod Touch via WiFi only.
Q: I can’t get my Samsung Intercept to fully connect to DFS or QPXT/QXDM, why not?
A: This is normal, the Samsung Intercept is locked down doesn’t work correctly with these programs and that is why we are using ADB, logcat, and Anycut to work around this. You shouldn’t need to connect it for anything other than the AAA key.
Q: Can Virgin Mobile help me set up my Epic 4G to be used on their service?
A: No, and even talking to them about it will probably result in your account being suspended.
Q: Do I port my number before reprogramming my Epic 4G over?
A: Yes. Set up a Virgin Mobile account using a Samsung Intercept (or other Android phone) and port your number from a previous carrier over to Virgin Mobile during this activation. Your line should be working normally on your Virgin Mobile specific phone before you try moving over your Epic 4G.
Credits go out to brooksyx for the CM7 and CM9 MMS fix and to Shinydude100 for writing the first non-visual guide on XDA. If you have an XDA account throw them a thumbs up or even a couple bucks, and if you found CDMA DFS useful feel free to throw them a dollar as well.