The Cingular SIM manual network hack thread

[lazieboss]

The Cingular SIM card blocks the Treo 650 from allowing it to access manual network select (OPTIONS >> SELECT NETWORK in phone app). This is very inconveinient because there are a lot of problems right now especially in NYC with Cingular Orange and Blue towers etc. In my house, the new Cingular Blue has 1 bar of service while Cingular Orange has 4 bars. My 650 always wants to stay on the Blue network even though the 64k smartchip is "supposed" to log onto the closest, higest service network.

us Cingular 650ers NEED a hack to allow us to access this manual network menu. I will do ANYTHING to get it so I can have my service back. My old Motorola v600 had a seem edit that let the phone bypass the sim block of this menu. I am sure someone can write a program or hack that can accomplish the same thing.

Pleaseeee

[jetkins]

I'd like top see this, too. Not because I need it at this time, but because it's part of the standard GSM functionality, and carriers blocking standard functionality just ****es me off.

[LewisL77]

I agree. I have the same problem lazieboss has. At home I have access to both orange and blue towers. I get great reception on orange, horrible on blue. But my treo always tries to connect to the blue tower.

[lazieboss]

yeah, doesnt that just **** you off. i realize cingular is just trying to save themselves money cuz they think if they allow it, people will go off and roam on any carrier unnecessarily, but cmon! if i cant get good service on CINGULAR, why cant i just switch to the other CINGULAR and have service!!

wheres all the hackers/crackers/etc LOL

[lazieboss]

anyone?

[driddle]

Are you 100% sure this is because of the Cingular SIM card and not the f/w in the phone? I ask because I switched from a Treo600 to a SonyEricsson P910 and I can do a manual network select.

FWIW - I ended up changing phones because I like you had this issue in the Orlando area and I also had issues traveling internationally. This one item alone was enough to make switch.

Has anyone tried a Cingular SIM card in an unlocked phone?

[rg1]

The recent (past 2 - 3 yrs) Cingular SIM block network selection. A phone can override this as is likely the case for you SE P910.

[Cook]

I have a stupid question. How do you know if you are on an orange tower or a blue tower?

[jetkins]

Originally Posted by driddle

Are you 100% sure this is because of the Cingular SIM card and not the f/w in the phone?

100% positive. If I insert my wife's Cingular Blue (ATTWS) SIM, the Network Select menu option magically appears; switch back to my Cingular Orange SIM and it's gone again.

Apparently some phones refuse to honor this block request from the SIM - what we're hoping is that someone can find a way to make the 650 do likewise.

[dimensiondvdrob]

Originally Posted by driddle

Are you 100% sure this is because of the Cingular SIM card and not the f/w in the phone? I ask because I switched from a Treo600 to a SonyEricsson P910 and I can do a manual network select.

FWIW - I ended up changing phones because I like you had this issue in the Orlando area and I also had issues traveling internationally. This one item alone was enough to make switch.

Has anyone tried a Cingular SIM card in an unlocked phone?

This is not the same thing, driddle...Your P910 is an UNLOCKED phone, as is my Treo 650 and I have the ability to switch networks. The unlocked GSM phones are definitely the way to go vs. purchasing the branded (and partly handicapped) carrier phone. Of course, you pay more for the unlocked version, but for me, the extra $ is worth not worrying about removed features. I got my phone as it was intended to be sold.

[taylorh]

Originally Posted by driddle

Are you 100% sure this is because of the Cingular SIM card and not the f/w in the phone?

Definately the SIM. I've been through this for the last year trying to find a solution. People have found a way to hack the firmware of some phones so that it 'ignores' the SIM's setting to lock the manual network selection.
You would think the Treo would be one of the easier phones to hack in this respect, but I don't think anyone has really tried.
I would love one though!

My (current) TMobile pre-paid and my former AT&T SIM both had/have manual net select enabled, the Cingular has it locked. They started programing the SIMs this way roughly 3 years ago and Cingular can NOT OTA re-program them to re-enable the feature.

[taroliw]

Originally Posted by lazieboss

In my house, the new Cingular Blue has 1 bar of service while Cingular Orange has 4 bars. My 650 always wants to stay on the Blue network even though the 64k smartchip is "supposed" to log onto the closest, higest service network.

I had exactly this same problem here in the SF Bay Area, after having moved to Cingular with a Nokia 6820 and then later getting an unlocked 650. Calling Cingular revealed that because they assumed my device didn't have the ENS feature -- which is what allows a phone to have multiple "home" networks -- they didn't actually provision service to my SIM to use that feature! Reprovisioning completely fixed my problem, so that now it doesn't matter which network(s) I'm near... it always choosed the strongest. I went from 1-2 bars at home (Cingular networks sucked here) to 4-5 (which is probably the old ATTWS towers, but who cares now?).

I don't know that the cause is the same in your case... but if you're seeing behavior that suggests you're not taking advantage of ENS, then talk to them about reprovisioning it. And, of course, you have to have an "orange" SIM, too.

[DHart]

I apologize if this is a bit off topic but it is very related. I was in Mexico last week and could not get any service whatsoever. I travel there a lot. Cingular has the phone programmed to use TelCel, the largest provider in Mexico. I assume they have some sort of agreement with them. As has been pointed out here, the network selection feature is not available on Cingular's menus on the 650, so I could not select another provider to see if there was a signal.

I contacted Cingular in the US. Turns out that the "network communications bridge" in Mexico has been swamped with increasing wireless traffic between the US and Mexico. So it has been going down recently.

In the course of the conversation with Cingular, they offered to give me the unlock code (which, of course, I jumped at). I successfully unlocked the phone. But the network selection feature is still not on the menus. Questions:

1. Is the lock contained in ROM or on the SIM?
2. If I upgrade the ROM using the Cingular upgrade, will the phone become locked again?
3. Would it be smarter to upgrade using the unlocked GSM method or wait for the official Cingular upgrade?

I am also very interested in a hack to make the network selection feature available. Anyone? ShadowMite?

[screwhead]

The original firmware on my treo 600 cingular branded had network selection enabled. After I updated the firmware it went away, so there must be a way to do it through the firmware.

[shadowmite]

I'm sorry, but this is something I will not be doing. Remember I am a sprint user and as such do not have the hardware to play with a GSM phone for this. But yes, it should be a easy hack with what we know about the 650. You simply need a GSM user who knows as much as me...

I'm not going to hold someones hand through the process, but I'll tell you:

A) Using the tools at my site, open the phone program and overlays and find the network select menu

B) Open the phone program and find all instances of the menu handles used for that menu

C) Alter as needed to ensure the menu WITH the select is chosen rather then the one without

D) Build GSM custom rom with this phone program instead. YOU CAN NOT HAVE THE PHONE PROGRAM IN RAM... That's one of the few that appears to be called by addresses to rom only. As such this might be risky, only do this if you know what you are doing.

[DHart]

Shadow -

As usual, even when you say you can't help, you offer great help. Thank you. I am not smart enough to tackle this, but maybe some of the GSM'ers here can accomplish it. Thanks again.

[mcdan333]

I did a little (~45 min) of digging, and here is what I've found. In the unlocked GSM 1.23 code, there are several different MBAR resource in PhoneApp_enUS.oprc that relate to network selection:

Select Network option present: 0x44c, 0x5dc, 0x708, 0x1b58
NO Select Network option present: 0x44d, 0x5dd, 0x709, 0x1b59
Select Band option: 0x44e, 0x5de, 0x70a, 0x1b5a (is this for CDMA?)

The subroutine that selects between these menu options seems to be at offset 0x1fb36 in code resource #1 of PhoneApp.bprc. I can post a disassembly if someone wants to delve into it. I will probably get to it later, but I don't have the time right now.

Shadowmite, thanks for getting me started.

[taroliw]

Originally Posted by DHart

1. Is the lock contained in ROM or on the SIM?
2. If I upgrade the ROM using the Cingular upgrade, will the phone become locked again?
3. Would it be smarter to upgrade using the unlocked GSM method or wait for the official Cingular upgrade?

The lock isn't in the ROM or SIM. Upgrading your ROM with the "unlocked" GSM code doesn't unlock your phone. "Unlocked" might as well be understood to mean "unbranded". The ROW code only gets loaded (originally) onto Treos that were sold originally by Palm and were never involved in a carrier subsidy situation. Branded phones (such as Cingular, who's code will show up as CNG), even after being unlocked will be running the same code. And the generally available updaters don't let you change which "branding" of code you install. People are currently taking advantage of the fact that some ROW installers (1.15, 1.21, 1.23) don't check the branding of the code on the device before they install. But note that the 1.28 updater (TreoUpdate-1.13) does check that you are running ROW before it installs.

What Cingular did, by helping you unlock your phone, is enable you to buy service from a local carrier for the duration of your trip. The lock prevents anyone's SIM but your carrier's from working in the phone. By unlocking it, you can now change your carrier at will simply by changing the SIM in the phone. Lots of people do this with GSM service to avoid international calling rates when travelling abroad. If you do it frequently, then you might have regular service for your most common destinations... but you could also buy minute-based plans to just cover you while on shorter or more infrequent visits.

[mcdan333]

Originally Posted by mcdan333

I did a little (~45 min) of digging, and here is what I've found. In the unlocked GSM 1.23 code, there are several different MBAR resource in PhoneApp_enUS.oprc that relate to network selection:

Select Network option present: 0x44c, 0x5dc, 0x708, 0x1b58
NO Select Network option present: 0x44d, 0x5dd, 0x709, 0x1b59
Select Band option: 0x44e, 0x5de, 0x70a, 0x1b5a (is this for CDMA?)

Ok Shadowmite, got another question for you. Do these .bprc files have a checksum in them anywhere that I need to recalculate? I have patched a few bytes in PhoneApp.bprc which I think will allow the Select Network menu to appear. They are pushing MBAR ID numbers on the stack in preparation for calling FrmSetMenu:


0001FBD4 MOVE.W #$05DD,-(A7) ; '].' | 3F3C 05DD Changed to 05DC
0001FBD8 MOVE.W D3,-(A7) | 3F03
0001FBDA BRA.W *+$0030 ; 0001FC0A | 6000 002E
0001FBDE MOVE.B D5,-(A7) | 1F05
0001FBE0 MOVE.W #$044D,-(A7) ; 'M.' | 3F3C 044D Changed to 044C
0001FBE4 MOVE.W D3,-(A7) | 3F03
0001FBE6 BRA.W *+$0024 ; 0001FC0A | 6000 0022
0001FBEA MOVE.B D5,-(A7) | 1F05
0001FBEC MOVE.W #$1B59,-(A7) ; 'Y.' | 3F3C 1B59 Changed to 1B58
0001FBF0 MOVE.W #$1B58,-(A7) ; 'X.' | 3F3C 1B58
0001FBF4 BRA.W *+$0016 ; 0001FC0A | 6000 0014
0001FBF8 BSR.W *+$205E ; 00021C56 | 6100 205C
0001FBFC TST.B D0 | 4A00
0001FBFE BEQ.S *+$0016 ; 0001FC14 | 6714
0001FC00 MOVE.B D5,-(A7) | 1F05
0001FC02 MOVE.W #$070C,-(A7) ; '..' | 3F3C 070C Changed to 070B
0001FC06 MOVE.W #$070B,-(A7) ; '..' | 3F3C 070B

[shadowmite]

I think that looks good... Didn't go over it to much, you seem to know what you are doing!

As for a checksum, I have never noticed any nor have I done that for any program I have patched to date. So you should be ready to give it a whirl. The biggest problem being that it HAS to be in rom to try it. If there were another way it would be nice, and feel free to try. But the last time I went playing with the phone app (trying to find the push to talk stuff) I could not enable my changes without putting it in a custom rom.

Good luck!

P.S. Actually, if you mean the md5 sum for the zip file, you might need to recalculate that...