GsmTracer
24th July 2007, 11:48
Use this only in education purposes, and this shows how 1024 RSA key,AES,etc on N95 can be avoid using ONLY 32 CPLD logic cells!
You need:
Xilinx CPLD xc2c32a-6-qfg32
push button
some copper wire,etc
You have to program CPLD with file "n95unlocker.jed"
Details about xc2c32a can be found on Xilinx: The Programmable Logic Company on document "ds310.pdf"
On same site can be found FREE tools for programing, also look for FREE simple
JTAG interface for Xilinx devices.
Solder:
pins 11,21,26 to GND
pins 4,12,20,27 to VCC +1.8v (more than 2v will destroy chip!!!)
(Don't forget to solder small smd 100nF on GND and VCC!)
pin 6 = clk (test point)
pin 7 = ad0 (test point)
pin 8 = push button (and second end of push button to GND)
pin 14 = jtag TDI
pin 15 = jtag TMS
pin 16 = jtag TCK
pin 25 = jtag TDO
Jtag wires is used only once to program xc2c32a and can be removed after
programing.
Unlocking procedure:
===============
First, be sure that version of N95 is: V 06wk41v23.4 17-04-07 RM-159 (c) Nokia
Next, you can make backup of field 308,1
Dissasemble N95 and solder 4 wires: ad0,clk,vcc,gnd
Use some isolating tape on edge of N95 board and assemble N95.
Power phone WITHOUT SIM card inside!!!
Once phone enter OFFLINE mode, enter: #pw+aaaaaaaaaaaaaaa+b
(aaaaaaaaaaaaaaaa= can be any 15 digits number,b = appropriate provider
unlock key Nr from 1 to 7 !!!)
now press push button and fast enter on phone #
If everything is ok, PHONE WILL BE UNLOCKED! and you can remove 4 wires.
Big Thanks to Dejan Kaljevic
You need:
Xilinx CPLD xc2c32a-6-qfg32
push button
some copper wire,etc
You have to program CPLD with file "n95unlocker.jed"
Details about xc2c32a can be found on Xilinx: The Programmable Logic Company on document "ds310.pdf"
On same site can be found FREE tools for programing, also look for FREE simple
JTAG interface for Xilinx devices.
Solder:
pins 11,21,26 to GND
pins 4,12,20,27 to VCC +1.8v (more than 2v will destroy chip!!!)
(Don't forget to solder small smd 100nF on GND and VCC!)
pin 6 = clk (test point)
pin 7 = ad0 (test point)
pin 8 = push button (and second end of push button to GND)
pin 14 = jtag TDI
pin 15 = jtag TMS
pin 16 = jtag TCK
pin 25 = jtag TDO
Jtag wires is used only once to program xc2c32a and can be removed after
programing.
Unlocking procedure:
===============
First, be sure that version of N95 is: V 06wk41v23.4 17-04-07 RM-159 (c) Nokia
Next, you can make backup of field 308,1
Dissasemble N95 and solder 4 wires: ad0,clk,vcc,gnd
Use some isolating tape on edge of N95 board and assemble N95.
Power phone WITHOUT SIM card inside!!!
Once phone enter OFFLINE mode, enter: #pw+aaaaaaaaaaaaaaa+b
(aaaaaaaaaaaaaaaa= can be any 15 digits number,b = appropriate provider
unlock key Nr from 1 to 7 !!!)
now press push button and fast enter on phone #
If everything is ok, PHONE WILL BE UNLOCKED! and you can remove 4 wires.
Big Thanks to Dejan Kaljevic