How To Get Your Epic 4G To Work On The Virgin Mobile Network

Scavenger Hunt Time, here are the tools you’ll need before we get started:   (Optional) Before we get started, if you want MMS (Multimedia Messaging Services) for picture messaging to work you’ll need to flash your Epic 4G to CyanogenMod 7 Nightly 45 Rebuild w/ Fix [Download Link].  Or if you are running CyanogenMod 9 you can just apply this fix. Disclaimer: Transferring a MEID/ESN between phones may or may not be legal in your region.  I cannot endorse illegal behavior but I am not a lawyer, so read up on the legal jargon yourself.  I’m also not responsible if you accidentally break your phone while trying to follow this guide.  :) If you don’t want to transfer your MEID from your Intercept to your Epic 4G for whatever reason, this tutorial will not work for you.  Otherwise, press on. Step 1: Get all of the data we need off of the Samsung Intercept. From your Intercept you need 5 things. First off, your MSL/SPC.  The MSL/SPC is needed to unlock a special programming menu.  The other things you need are your AAA key, HA key, MSID number, and Directory number. The AAA key and MSID are unique and assigned by Virgin Mobile and you can’t get them anywhere except off of your own personal Samsung Intercept that is currently activated on the Virgin Mobile network. The first thing you need to do is Install PC Studio 3 on your computer.  Download it from the link above, it’s important that you get it from the above link. Important: Don’t plug in the Intercept before installing PC Studio 3!  Doing so may install the wrong drivers. Now on your Intercept, connect to the Android Market via 3G (your phone should be activated on a Virgin Mobile account at this point).  Install ConnectBot and AnyCut.

Open Connectbot on the Intercept and click the down-arrow next to ssh and change it to local.  Type in any Nickname you want and press return.  In the next window type: This is capslock sensitive! The 6 digit number that appears is your SPC/MSL number.  Also known as your phone programming code. Write this down, you’ll need it in the next step. Now that you have your SPC/MSL number, we can go get the HA and AAA passwords. Tap and hold an empty spot on the Intercept’s Home Screen and select to add Shortcuts. From the next list select Any Cut > Activity.  A huge list of activities will generate; scroll down to Data. There will be about 12 different Data entries, but you want the 2nd one down from the top. Now back on the Intercept home screen click your new Data shortcut. The Data Programming interface should open up. Tap Edit, enter your 6 digit MSL/SPC number, tap Data Profile, and STOP HERE on the data profile page. Now you need to load up ADB on the computer, and make sure the Intercept has USB debugging enabled.

Make sure ADB Standalone (or the Android SDK equivalent) is extracted on your computer and ready to go. Run ADB.bat from the zip and plug-in your Samsung Intercept via USB. In the ADB command window type “adb logcat” and then go back to your Samsung Intercept and tap the Username box at the top of the Data Profile window. This will make the Intercept dump a ton of information into the ADB window. Now on the Intercept Tap Cancel, do not save any changes, and back exit out of the Intercept’s Data menu. Back in ADB, as soon as possible push Ctrl + C on your keyboard to stop logcat, the data you need is ready to read.  Right-Click the ADB window select Find…  In the find box type “aaa_pw” and your AAA key will be listed right after it. While we are in here you can also find your HA Key, which should be “vmug33k” but you can check for yourself if you like.

So now you have your Intercept’s AAA key, and the HA key. Write them down in notepad and email them to yourself. You don’t want to ever lose these. To reiterate, the AAA key is the password after aaa_pw: and the HA key should be vmug33k.  Don’t share your MEID or AAA key with anyone! Your MSID can be found by going to Homescreen > Menu > Settings > About phone > Status. It may also be found by accessing the ##847446# menu from your dialer. Your Directory number is your real phone number, whether it was assigned by Virgin Mobile or ported through to Virgin Mobile from another carrier. You can now disconnect the Intercept, we’re done with it. Step 2: Write the Intercept’s MEID to the Epic 4G Your Intercept’s MEID can be found on the back of your Intercept underneath the battery, it is also the first A00000##### part of your @mdata.vmobl.com username from the previous step. Note: Remember this next part! To write it to the Epic 4G, you need to connect the Epic 4G via USB cable and then open up QPST and QXDMA. Now on the Epic 4G, open the Dialer and type ##8778# and then switch the USB mode to MODEM. Your Epic 4G will have to be literally on this screen, with USB set to MODEM, anytime you want to connect to QPST, QXDM, or CDMA DFS.

Now go to QPST and click Add New Port… Uncheck “Show Serial and USB/QC Diagnostic ports only”. Two COM ports should show up in the box, the one you want is most likely the top one in the list. Select it and click OK. Troubleshooting: The com ports are random numbers depending on which USB slot you have your phone cord plugged into; they probably will not be the same ports shown in the screenshot below. If the ports are not showing up properly try the following:

Toggle the USB mode back to PDA and then to MODEM again.Exit and re-enter the ##8778# utilityDisconnect and reconnect the phoneExit and go back into the Add New Port windowUninstall and reinstall the Samsung Drivers (linked at the top of this page)If you already had QPST, reinstall using the version linked above.Open Task Manager and kill the ADB.exe process

If you connected to the correct port your phone will be listed as FFA6550-ZRF6500.

Now go into QXDM and select Options > Communications.  Set the Target Port to the one your phone is on and click OK.

Now type the following commands into the white Command box: The first command enters the default Samsung 16 digit programming password to unlock the phone. The following two commands list your Epic’s current MEID and ESN, write them down if you want them for your own records. The third command writes the Intercept’s MEID to your Epic 4G, note that you must enter “0x00” before the actual MEID.  The rest confirm the change and set the SCM to 0x3A.

You can exit QXDM now, you shouldn’t need to use it again unless you accidentally mess up the ESN later on. Step 3: Reprogram in QPST Go back to QPST and select Start Clients > Service Programming.  A new window should pop-up with a phone selection screen, just click OK. Note: You need QPST 2.7 Build 355 in order to properly program the Epic, so if it isn’t working you probably have the wrong version and need to download the one from the link above.

At the bottom left of the tool click Read from Phone.  In the pop-up that appears enter 000000 and click OK.

(Optional) On this first Settings page change the Service Programming number to 000000 One tab over you’ll find the CDMA page.  In the Directory # type your actual phone number. In the IMSI_S box type your MSID number.

Now go straight to the M.I.P. page and use the Edit button to set profiles 0 through 2 to the following and enter the HA and AAA keys as text string (see screenshot below):

Now go to the PPP Config page. Enter data on each tab accordingly: RM tab doesn’t let you modify anything

Once you have all of the above settings put into QPST, click Write to Phone.  The Epic should restart.  Do not disconnect your cable until it has rebooted, but leave it connected anyway since you’ll need to do some more programming in DFS.

Step 4: Program the Epic 4G in CDMA DFS Connecting your Epic 4G to the CDMA DFS Tool can be a little tricky. Open the ##8778# menu and switch USB to MODEM like we did with QPST. And, the same troubleshooting tips apply if it doesn’t work. Open up DFS. A login screen should appear and unless you’ve donated or purchased the program you won’t be able to log in. Just click the X at the top-right and close this window to make the real program open up in demo mode. Once in DFS, click the Ports button and then right-click the port that has your “Samsung Mobile Modem Diagnostics Serial Port…” listed and Add the port. Then exit the Port Manager and use the drop-down menu next to it to select your device. If you see just plain Samsung Mobile Modem, that is not the correct port.

As soon as you select the correct port the screen should light up with yellow status information. Now go up the top and either enter your Epic’s SPC code 000000 in the box, or 01F2030F5F678FF9 in the password box and then click the blue > send arrow next to it.  Either one will unlock the device so you can make changes. If done correctly you’ll see a blue DEVICE UNLOCKED message in the bottom console.

Now go to the Programming tab, and then the Data sub-tab.  Under account settings, enter yourMEID#@mdata.vmobl.com on every UID line.  On every Pwd line enter your AAA key.  Once entered, hit Write and then reboot the Epic.

The only thing left to do now is to update the PRL. Connect back up to CDMA DFS and visit the Programming > NAM tab. Under PRL click the Load button and select 01120.prl that you downloaded from the at the top. Finally, hit Write to save it to the phone and then reboot the Epic one last time. Note: Before writing the new PRL, you may want to backup your current/old PRL in case something goes wrong. To do so click the Save button a choose a place to copy it onto your computer. All done!  Your Epic 4G should now be working on Virgin Mobile.  No activation app or any other doo-dads required.  Feel free to drop a comment below and let us know how it went.  Or, start a help request in the free Answers community if you need assistance! Q: Why do I need to buy and activate a Samsung Intercept on Virgin Mobile if I want to use an Epic 4G? A: A donor phone is required in order to acquire the MEID/ESN number and AAA password key unique to your Virgin Mobile account.  A Samsung Intercept happens to be the cheapest 3G Android phone offered by Virgin Mobile, you can pick up a rough shape one on eBay for under $50. Just make sure it is marked GOOD ESN or else it is not usable on Virgin Mobile. Q: Will I be able to use my Samsung Intercept in addition to my Epic 4G? A: No, not as a phone, and this is in most cases illegal and considered fraud. Once you get your Epic 4G working on Virgin Mobile your Samsung Intercept will need to be powered off and stored somewhere safe.  You can theoretically take the sticker off the back and zero out the MEID/ESN and use it for a different carrier or sell it.  The Intercept cannot be used on Virgin Mobile again until you stop using the Epic 4G.  I recommend that if you have an unusable Intercept lying around you put it in Airplane Mode, zero out the MEID, MIN, and DIR, (removing all possible connectivity) and use it as an Android-powered iPod Touch via WiFi only. Q: I can’t get my Samsung Intercept to fully connect to DFS or QPXT/QXDM, why not? A: This is normal, the Samsung Intercept is locked down doesn’t work correctly with these programs and that is why we are using ADB, logcat, and Anycut to work around this.  You shouldn’t need to connect it for anything other than the AAA key. Q: Can Virgin Mobile help me set up my Epic 4G to be used on their service? A: No, and even talking to them about it will probably result in your account being suspended. Q: Do I port my number before reprogramming my Epic 4G over? A: Yes.  Set up a Virgin Mobile account using a Samsung Intercept (or other Android phone) and port your number from a previous carrier over to Virgin Mobile during this activation.  Your line should be working normally on your Virgin Mobile specific phone before you try moving over your Epic 4G. Credits go out to brooksyx for the CM7 and CM9 MMS fix and to Shinydude100 for writing the first non-visual guide on XDA.  If you have an XDA account throw them a thumbs up or even a couple bucks, and if you found CDMA DFS useful feel free to throw them a dollar as well.

1. I am guessing it is easier, if you already have a Virgin Mobile phone?
2. What if we just bought a unlocked Sprint EPIC 4G phone? I am assuming that the instructions would be a lot easier, if we already had a Virgin Mobile phone to go with an unlocked Sprint EPIC 4G?
3. Yeah, you need to have an ACTIVE Virgin Mobile phone already working in order to do this. It has to be a “official” Virgin Mobile phone. The Intercept is recommend because it’s the cheapest.
4. Whether the Epic 4G is unlocked or not won’t make any difference. Just get the cheapest / best condition one you can find. The only thing that will make a difference is if the Epic 4G is flashed to use Cyanogen Mod, which has a fix to allow picture messaging on the VM network. 0×00A0000000000000 to 0×A0000000000000 that seemed to get past the “unable to build buffer error” Good Luck To fix error 16 you need to call in to Sprint’s Error Code 16 Dept from another phone. The number to call is 1-877-492-9605 Tell them you are a Virgin Mobile customer and you are receiving error code # 16. Give them your name and Virgin Mobile phone number. They will have access to this since Sprint owns and leases out Virgin mobile. If asked what type of phone you are using tell them a Samsung Intercept (or whatever phone you officially have registered with Virgin Mobile). They will reset the line and the error code should go away within a few minutes. I don’t recommend telling them anything about the Epic or bringing an unofficial phone over to the service. If the line is still not working, double check your Epic’s MEID in QXDM to make sure it matches the Intercepts. Then in QPST make sure the DIR and IMIS_S number match up with your real phone number and MSID. Note that the MSID should look like a real phone number, but usually not your actual phone number that people call into. Suggestions

1. When in the Intercept’s Data Programing, one should stop after entering the MSL. I would stop at Data Profile menu, run logcat, then tap Username–I was never able to retrieve the credentials I was looking for in the logcat summary. Only after starting logcat at the menu immediately after enting the MSL was I able to have logcat output the aaa_pw.
2. “RequestNVItemWrite meid” should be entered in all lower-case letters: requestnvitemwrite esn I would get an error message regarding a buffer when entered in camel-case. Please help. Here’s the direct download link to the latest version of the Anycut APK I pulled off of my phone: https://dl.dropbox.com/u/4033057/Any%20Cut-100.apk Thanks for the heads up too, I went ahead and added this link as a mirror at the top of the article. “If coming from the Optimus V it is very easy to get your HA and AAA keys. First use LGNPST with the LS670 dll. Click on phone settings and read and it will get your phones data settings but will not display the passwords yet. Next disconnect the program and close it. Use DFS cdma tool next to read and ABRA CADABRA your AKEY, HA, AAA, and everything is right there on display. Also for those of you with data problems I have my three G working solid. You really need to use at least two different programs to doouble check your work. I noticed that with QPST and DFS I would get different readings on the SPI settings and the Hexidecimals for the passwords. One would say 21EF for the SPI and one program would say 8687 and yet another read 1234 to me. So I recomend downloading all the demo or buying, CDMA software that you can and reading your phone. Most important though is first scan with LGNPST IT WILL OPEN YOUR PHONE TILL REBOOT!” If Voice/SMS is working, but DATA isn’t – you have 2 possible problems.
3. Your AAA/HA keys could be incorrect. They should be written in text string, and the HA key should be all lowercase “vmug33k.” The AAA key is cap-sensitive so it needs to be exact.
4. You may be entering the A00000MEID@mdata.vmobl.com incorrectly on the M.I..P page or the data pages. Also make sure for the 2nd profile that both the Tethered and NAI are @prov.vmobl.com and/or password may be incorrect. Please try again. If this problem persists, you may need to contact Sprint. Mobile node failed authentication Samsung Drivers I can’t seem to click the correct link to actually download them? And •CDMA DFS The page does not exist anymore, so is it the same as the free download, because it doesn’t show the phone? Thanks!!! Raymond If you aren’t getting service, go into QPST and make sure that you enter in the MDIR number first, and the MSID second. Also check with QXDM and make sure you are using the intercept’s MEID (ESN) Great guide though. Really helpful. Rob under Mobile netweok state it says connecting but it doesn’t seem to be doing anything..have any suggestions I have gingerbread El30 Thanks for the in depth guide!! Thanks so much, David THanks, and i get RequestNVItemWrite meid 0×00A000002891998B
5. When writing the new MEID I had to put a capital X just like someone else mentioned. The set of ???’s will work on some phones, but not with the Galaxy S series. This means if your donor phone has ???’s, remove them when entering the key on the Epic. The downside to that is, the Evo is $239. I did this with both the Epic and Epic S2 (Touch) I imagine it would need to be jailbroken. It theoretically is possible though, given that the Verizon iPhone is CDMA just like Virgin Mobile (Sprint). I did run into issues installing QXDM in Windows 8. When I tried to install it I got an error where it was testing for a version of IE > 6, but apparently 10 doesn’t count. I tried compatibility mode but only have Previous Windows version available when it appears that you really need XP. This might be a limitation of 8 Home but is good to note. I still needed compatibility mode in Windows 7 to install, but that worked without issue. Thanks again! Interesting that Windows 7 required compatibility mode for QXDM though, I never saw that issue. Could be related to the edition of windows (Ultimate vs. Home, etc) Yes you can retrieve them from a deactivated phone. BUT the phone must be active on the account or else the AAA key will not work. If the you try the use an AAA key from a deactivated phone Virgin Mobile will reject the connection and no service will go through. I was trying to get my ha/aaa password from a deactivated Samsung intercept, this an example of what i got “aaa_pw:w9l+olO6z4”, btw im only using alogcat adb didn’t recognize my intercept. I should get a similar result once the intercept its been activated right?, I guess I have to skip the + symbol. There is a chance that when the phone is activated that Virgin Mobile will reprogram it and issue a new AAA key, so trying to pull it now might be a waste of time. I recommend:
6. Activate the phone. 2. Make sure it works. 3. Then follow this guide and copy the keys over to your non-virgin mobile phone. Good luck Pablo, report back if you have problems. 1.Can i use my sprints ept4g? 2.Can i use 4g if i succeed in flashing it to vmobile since my evo3d is running native 4g? 3.If 4g wont work on my et4g can i just turn it off and turn on my evo3d4g and use 4g service there? Thank you very much If you already have 4G active on Virgin Mobile, then you just need to transfer the WiMax keys over to the ept4g. I don’t have the instructions for doing so, so you’ll have to Google it because the 4G modem is completely separate from the 3G/voice/text one in this article. You can’t use both phones at the same time. If the carrier detects dupliacate cell keys connecting to 3G/voice/text it will issue a block on your duped phone and result in an error #16. The problem with your idea is that in order for the evo3d to connect to 4G it must first be able to find the towers over 3G/voice/text. Of course if you put one phone in airplane mode it won’t connect to 3G/voice/text and you can use it just fine, even over Wi-Fi. I don’t think 4G works while in airplane mode, but please correct me if I’m wrong. If 4G does work while the phone is in airplane mode then you certainly could do this, otherwise no.