IMEI changing kit for GTA02

joerg Reisenweber joerg at
Sat Feb 8 07:06:02 CET 2014

On Sat 08 February 2014 01:54:44 Michael Spacefalcon wrote:
> joerg Reisenweber <joerg at> wrote:
> > you recall that single line I actually censored?
> line 60, I assume.

Yes, that one.

> > (Must have been the only time
> > in my life I did this) In the changelogs, around moko5 or something.
> Considering the time proximity between this hack and the moko5->moko6
> change in which you (not you personally, but the company) went backward
> from the sensible approach (used in most other TI-based products too)
> of storing configuration items in FFS to the non-sensible approach of
> hard-coding them in the fw, let me make a guess: the crappy Weendoze-
> only host tools for development and production which TI gave you (for
> FFS programming in this case) were unreliable, and you were looking
> for a way to avoid needing to do any FFS programming through the RVTMUX
> interface (TI's official way) at all.  Of course the IMEI is one item
> which can't be hard-coded in the fw, and if you didn't want to (or
> couldn't) use the "proper" RVT/ETM-based method of programming, then
> you had to hack in some other way, such as a special AT command.
> But I assume that the issues with TI's production testing and
> programming tools must have been solved in time for GTA02A7 mass
> production, as my unit came with a /pcm/IMEI (IMEISV really) setting
> which cannot be programmed via that AT at SC hack, only via the proper
> RVT/ETM channel.
> I also find it cute that all mass-produced GTA02 units (at least the 4
> that have been liberated so far: mine, David's, Norayr's and Giacomo's)
> came with a few files in FFS (/pcm/CGM[IMR]) which are not used by any
> of your fw's from moko6 onward, only by moko5 - surely flashing a GTA02
> back to moko5 is NOT recommended (I even remember seeing admonitions
> somewhere to never do that), yet those files seem to be there just to
> support those people who might do that...  Wasn't it your inability to
> write these strings into FFS reliably that made you go back to hard-
> coding them?

I have no idea, I took care about GSM firmware only much later. But I think 
until the point in time when I was able to contract Dieter Spaar for OM, there 
been significantly less knowhow about all that stuff inside OM than what you 
demonstrate here. After Sean Chiang left, the domain had nobody savvy how to 
handle all that, iirc. And the whole stuff been even temporarily considered 
lost forever, thanks to reformatting of a laptop HDD (iirc). Also see bug #666 
which got fixed in moko5 but evidently the patched lib TI provided for that got 
dropped for no reason in later fw versions, until Dieter noticed that and 
included it again in Moko9-Beta1

> > It actually been a weird "secret" AT command to change the IMEI, it
> > claimed in changelogs that it had some really weird formula to add
> > birthday^5 to old IMEI or sth and append that to the new IMEI, for
> > "authentication" - and it never worked afaik.
> So I assume we are in agreement then that this "secret" AT at SC command
> is NOT recommended for use?

Yes, definitely. I think this command never really worked. And for obvious 
reasons it never been tested thoroughly, I guess.

When I had to tinker with calypso IMEI I'd probably rather resort to your 
tools than try this command or ti_tat

()  ascii ribbon campaign - against html e-mail     
/\   - against proprietary attachments
(alas the above page got scrapped due to resignation(!!), so here some 
supplementary links:)  (German)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <>

More information about the community mailing list