For Best results, instead of this guide, use ->  Getting Alltel V3C/V3M/K1M Monster firmwares working: A more Automated Process

Updated: 01/15/07 11:24 am

Using the Alltel Monster firmware on your Verizon Phone.....

PLEASE SEE THE WIKI for the Pros/Cons of using the Alltel firmware FIRST!!

Currently, Verizon V3C, V3M, and KRZR K1m MONSTER firmwares have been leaked, so if you can NOT get this working, you can flash back to the Verizon Monsters and be just like the "fresh out of the box" Verizon state.  See -> Flash from Alltel Firmware back to Verizon's Firmware.

This has only been tried on the V3C, V3M and Krzr K1M Alltel monster firmwares, it may or MAY NOT work on other phones.

Please Note: This process is NOT 100% fool proof, there are varying degrees of success.  For additional background, you're welcome to read -> Getting Non-Verizon Monsters working: The only thing consistent is inconsistency

Preface:   When reading this write up, keep in mind its composed of work directly quoted from several sources... Each author has his own writing style, as such, it may not be a "smooth flow"...   Because of this, it also makes it difficult to credit each contributor where credit is due...

This process and MIP fix developed by Jlbrightbill; thanks to DanFPW for the KRZR K1m groundwork, GoldMembr for MMS fixes, and Mark_Venture for backup instructions.   And thanks to cpuguy06 for compiling board members' posts into interim instructions before this tutorial was written.

Additionally what you do NOT see represented here are the extensive PM's and offline discussions of  jlbrighbill, KBMAN and Goldmembr on the various concepts, flow, steps, requirements, problems, etc...

This work was also pulled together and refined based on discussions in the following threads...

Alltel V3C Monster -> http://www.howardforums.com/showthread.php?t=1064653
Alltel K1M Monster  -> http://www.howardforums.com/showthread.php?t=1069181
Alltel V3M Monster -> http://www.howardforums.com/showthread.php?t=1072371
MetroPCS V3C Monster -> http://www.howardforums.com/showthread.php?t=1067164
just to name a few...

As you can see.. a lot of people have worked hard to come up with this!!

Based on -> http://www.hacktherazr.com/forum/viewtopic.php?t=1410&start=140 by Jlbrightbill who also goes by Ancalagon on hacktherazr.com

NOTE: I may still have a few corrections/edits to make over the next few days/weeks??

Updated: 01/06/07 11:42 am

Required...

1.  USB Cable (see the FAQ)
2.  Install the Motorola USB Modem drivers.
3.  Install and configure Motorola PST v7.25 and its drivers, along with testing its connection (Formerly known as the Prep-work section of the Seem Edit page).  (Sorry, No WAREZ links here).
4.  Install P2KSeem for V710. (To install P2KSeem for V710.. Just unzip all the files in the archive you downloaded to a folder. It does not need to be "installed." There is no "setup" program.)
5.  Alltel Firmware flash file..  (obtain from http://www.humpa.com/vzw or http://ryfiles.com/flash or Phone Encyclopedia link at phonenews.com)
6.  QPST v2.7 Build 215 or higher  (NOTE: while Build 91 works for many, some have had issues using it that were resolved by switching to build 215)
7.  Install and configure QPST along with its requirements
8.  Install/Configure P2KCommander along with its requirements
9.  the seems, icons, and files indicated in the sections of the WIKI which I quote below...

The process...

1. Backup the phone...  (MV, files list by MV, jlbrightbill, kbman, Goldmembr and others)

Prior to completing these backups your phone must be running the Verizon Firmware... Active on your account and you have done a *228 opt 1, and *228 opt 2 on it, and the phone and all of its features must be completely working on the VERIZON Firmware!!  Failure to be in this state prior to starting will mean FAILURE in the end.

After you do a *228 opt 1 & Opt 2 on the phone you wish to convert... Activate a different phone on your account while flashing and fixing your V3C/V3M/K1M phone...

Example... I used VZW's My Account -> Activate phone, to switch to my V3C.. did *228 opt 1 & Opt 2... then used My Accont -> Activate, to switch back to my E815 while I then flashed and worked with the V3C... When all the fixes were applied and done... I switched back to the V3C being active on my account and tried it out... NOTE: I did NOT do a *228 after I switched back.

I am not sure how crucial this is, but it is something I did EACH TIME I ran through this process....

For how to use Verizon's "on line ESN Swapper" to switch which phone is active on your account.. Evade has a greate illustrated write up, so please see the ACTIVATE PHONE section of -> http://motorola.szczuka.org/Hollywood_VZW_Bell.html    NOTE: this will only work when switching between two EVDO phones...

OPTIONAL:
backup the file system... (Use BitPim to capture tree to zip file. Uncompress ZIP on PC. go folder by folder comparing PC's copy to phone's file system view in bitpim, make note of missing files/folders. Use P2KCommander and QPST to get the rest.)  This is not actually needed, but some like to do it, "just in case"....

The following are MANDATORY:
You must now backup the settings, config files, etc... which WILL BE NEEDED to restore later... 

NOTE: These files are essential to restoring your phone to a working state!  Do not proceed to flashing if you are unable to back up ANY ONE of these items!

Use Qualcomm QPST to backup service programming.....  Unplug your phone from the PC, power it off, then back on, and re-connect it to the PC.  Use the QPST Configuration program, make sure your phone is displayed/available... Select the port with your phone, then use the Start Client pull down, select Service Programming.     At the phone selection screen, your phone should be listed and highlighted, click OK.  Click the READ FROM PHONE button.  On the "Enter Service Programming Code" screen, enter 000000 (or your phones SPC), and click OK.   When the read is complete, and you see values filled in, click the SAVE TO FILE button.   The file name box will automatically be filled in as  your phone's ESN number  followed by  _SP... (example:  1A3333Ad_SP) click the Save button.   Click on the Connection pull down in QPST Service Programming, and click EXIT.   Exit the QPST Configuration program.

Use Motorola PST to backup additional files....  Unplug your phone from the PC, power it off, then back on, and re-connect it to the PC.   Start PST Phone Programmer.  Use the File pull down, and click on NEW.  Select BREW File, and click OK.  Use the Phone pull down menu and click on READ.  When the PST Phone Programmer Progress window indicates the Read Procedure has completed successfully, (it says "It's now safe to disconnect the phone"), close that progress window.   In the PST Phone Programmer window, use the File pull down menu, and click SAVE AS...   name the file, and click save...   

Repeat the process using PST to backup each of the following...   CDMA Enhanced Roaming Indicator (ERI) File, CDMA NAM File, CDMA Preferred Roaming File, Feature File, Mobile IP File (NOTE: you might get an error stating this may or may not be supported, click YES to continue, it will report Partially completed), MMS Data File, RTT Data File and RTT Browser File (NOTE: have Ver 6.x tab selected before you click READ FROM PHONE).

NOTE: Not all of the PST backups will be used for this process, but they are good to have "just in case..."

NOTE: You do not need to exit PST, or unplug/poweroff/poweron/replug between READ operations.

When you have finished, leave PST open because the phone is still in the mode where you can start backing up the SEEMS....

Use P2KSeem to backup seems....   With PST still open, launch P2KSeem for V710,  change the values for Seem Number, Bytes (h), and Record Number as needed.  Click LOAD FROM PHONE...  then click SAVE TO FILE button in the lower right. In the pop-up box, the name will be filled in automatically... example:  041a_0001.seem.  I usually like to call it...  041a_001.seem.ORG   then click Save.

do that for EACH of the following seems...

Seem 04aa Bytes 7A Record 0001
Seem 038e Bytes 7A Record 0001
Seem 01d1 Bytes 7A Record 0001
Seem 29a0 Bytes 40 Record 0001
Seem 29c0 Bytes 7a  Record 0001
Seem 2742 Bytes 00 Record 0001
Seem 2976 Bytes 40 Record 0001
Seem 2977 Bytes 40 Record 0001
Seem 2978 Bytes 40 Record 0001
Seem 2979 Bytes 40 Record 0001
Seem 2997 Bytes 20 Record 0001
Seem 299a Bytes 70 Record 0001
Seem 299b Bytes 70 Record 0001
Seem 29a1 Bytes 20 Record 0001
Seem 29a9 Bytes 40 Record 0001
Seem 29b2 Bytes 30 Record 0001
Seem 29b3 Bytes 30 Record 0001
Seem 29b6 Bytes 20 Record 0001
Seem 29ba Bytes 60 Record 0001
Seem 29bb Bytes 60 Record 0001
Seem 29bc Bytes 40 Record 0001
Seem 29be Bytes 90 Record 0001
Seem 29bd Bytes 90 Record 0001

Seem 29e9 bytes 82 Record 0001

Seem 01d2 bytes 7A Record 0001

Use BitPim or P2KCommander to backup the following files..

/nvm/seem/cdma_sec
/dmu/10.key

____________________________________

2. FLASH THE PHONE's FIRMWARE... (MV)

If you were unsuccessful backing up ANY of the files in section 1, please STOP and DO NOT FLASH YOUR PHONE!!!

Obtain the Alltel Monster for your phone from -> http://www.humpa.com/vzw  or http://ryfiles.com/flash

Please see the  ->  HOW TO FLASH  <- page for the latest updates/notes and FULL information.

____________________________________

3. Activate phone, Restore setting/config files, and Verify... (DANPFW)

For the next steps...  Do not restart the phone unless it says restart or PST does it for you. For the RTT Browser step, input your MIN in the username field of VZW proxy, (This is usually your phone number but not always), and your MDN (phone number) into the username field of the VZW_MMS proxy.

NOTE: If you have already made your own backups, you can use them instead of the ones supplied in the tutorial, especially the MMS Data and BREW configuration file.

1. Write VZW PRL and ERI files to phone with PST.
2. Activate and program phone by dialing *228, and selecting option 1.

    NOTE: some have contacted me about *228 failing, in this case try following the steps for Manual Activation

3. Write RTT 1x-Browser configuration file using PST. (Select Version 6.x tab before writing to phone) NOTE: Linked copy is KRZR K1M Specific.

• Prior to writing to phone...  locate the User ID field on EACH proxy tab.  replace the contents with your phone number. Example 9995551212

4. Write BREW configuration file using PST.   NOTE: Linked copy is KRZR K1M Specific.
5. Write MMS Data configuration file using PST.  NOTE: Linked copy is KRZR K1M Specific.

• Prior to writing to phone...  Locate the Album Upload Address field, it says <min> @pix.vtext.com,  replace <min> with your phone number.  So the field reads: 9995551212@pix.vtext.com

6. Edit the following seems.

• 29a9, read 7f bytes from phone, load seem from file, write to phone.
• 29bb, read 64 bytes from phone, load seem from file, write to phone.
• 29bc, read 42 bytes from phone, load seem from file, write to phone.
• 29e9, read 82 bytes from phone, load seem from file, write to phone.

7. Verify seems 01d1, 04aa and 038e contain your telephone number@vzw3g.com....  you will manually type in your 10digit#@vzw3g.com into 04aa (loads with bytes 0), and 038e (Load with 7a). After typing in the the values you will be a character left over from the previous seem, type 00 over the numbers in the left hand columns.

8. Verify seem 29a0 contains your telephone number@pix.vtext.com.
9. Verify seem 2977 contains testapps.myvzw.com
10. Verify seem 2979 contains apps.myvzw.com and apps2.myvzw.com

Edit the 2742 Seem

Offset: 001d Bit 3: Uncheck - Motorola Animation on Startup
Offset: 0024 Bit 2: Uncheck - Voice Mail on #1 speeddial
Offset: 0031 Bit 1: Uncheck - Motorola Animation on Shutdown
Offset: 004b Bit 0: Check – GPS icon
Offset: 005a Bit 7: Check – File Access in QPST
Offset: 005f Bit 7: Check – Video Quality
Offset: 0062 Bit 5: Check – Enable editing MMS server
Offset: 006a Bit 3: Check – Enable 1xrtt settings
Offset: 0074 Bit 7: Check – Service icon

____________________________________

4. correct MMS Setup (DanPFW & Alltel V3C Wiki)

Enter menu, Messages, press Options softkey for Message Inbox, press Select softkey for Inbox Setup, Select MMS Message Setup, Server Info, and verify the Server Name and Web Session Name match VZW values.   Service Name = VZW, Server Name = http://mms.vtext.com/servlets/mms,  Web Session = VZW_MMS.

NOTE: if you have used your backup of your RTT Browser File you must create the VZW_MMS web session as follows...  (Quoted directly from the Alltel WIKI)

Method 3
This is how I did it as it is easiest, I think anyway

after enabling both seem edits you can access web sessions menu by
from home screen hit #073887* this spells #0setup* so you can remember it
then password is 000000
create a new entry set it up as this:

Name: VZW_MMS
Homepage:http://homepage
UserID: 9995551212 (where 9995551212 is your 10 digit phone number)
Password:***(vzw)
Gateway IP1:000.000.000.000
Gateway1: mms.vtext.com
Service Type1:HTTP
Port 1:80
E2E Port 1:9201
LXL Port 1:0
Gateway IP 2:000.000.000.000
Gateway 2:
Service Type 2:
Port 2: 0
E2E Port 2: 0
LXL Port 2: 0

good now back out of menus
VZW should be selected as your default websession
then go to
inbox / Message Inbox / Options / inbox Setup / MMS Message Setup / Server Info / Options /Edit

Service Name VZW
Server Name http://mms.vtext.com/servlets/mms
Web Session name VZW_MMS

ok now back out of menus

NOTE: Sometimes the websession setting under this menu does not stick to VZW_MMS after rebooting the first time. Before you go to test MMS, be sure to check if the setting stuck. If not, set it to VZW_MMS again and it should stick after that. Attempting to send MMS messages with the websession set to the wrong setting could result in MMS messages becoming stuck in your outbox.

Now go to Main Menu / Settings / Security / Data Connections/ passwor is 000000/ 1xRTT Data. Verify that the following are set... If they are not, then change them....

User Name : XXXXXXXXXX@vzw3g.com (XXX=your TN)

Note: After you hit OK the phone might report… “Notify ALLTEL of change” just disregard !

Password : vzw

hit done

____________________________________

5. Enable GIN appmgr (DanPFW & Alltel V3C Wiki)

1. Start Motorola Software Update or PST.
2. Start P2Commander.
3. Copy alltelappmgr.bar to P2k:/a/brew/mod/brewappmgr/
4. Restart phone.

____________________________________

6. Disable EVDO (MV)

Update 1/5/07...  due to the newly added Section 10 of this page...  this step should not be needed!!

Disable EVDO <- use the link.

NOTE: Currently data services won't work on the Alltel MONSTERS having EVDO turned on.  This problem is still being investigated, however, as of yet, there is no known fix. UPDATE: see section 10!!

____________________________________

7. M.IP Fix (jlbrightbill)

Open QPST's Service Programming and load values from phone. Scroll to the M.IP tab, and select "Add". Configure the new profile as the screenshots indicate.  mip1ki4.png  and mip2bc6.png.

NOTE: tetherned NAI won't stay, but it won't affect the data fixes.

____________________________________
 

Verify (Fix if necessary) all seems outlined in the below quoted post..  as well as replacing 29c0  seem

The preferred method is to use the backups of your seems you made in the beginning, however the seems linked here may be used too...  If use use these linked/pre-edited seems, please be sure the reference your phone/phone number, etc. where applicable.

NOTE: some of these seems may be already set correctly due to using QPST/PST earlier...

8. More MMS fixes part 2

From Goldmembr....  http://www.howardforums.com/showpost.php?p=6723542&postcount=228

load the following seems to your phone one at a time....
Seems.rar


Seem 2976 Bytes 40 Record 0001
Seem 2977 Bytes 40 Record 0001
Seem 2978 Bytes 40 Record 0001
Seem 2979 Bytes 40 Record 0001
Seem 2994 Bytes 60 Record 0001
Seem 2995 Bytes 60 Record 0001
Seem 2997 Bytes 20 Record 0001
Seem 299a Bytes 70 Record 0001
Seem 299b Bytes 70 Record 0001
Seem 29a1 Bytes 20 Record 0001
Seem 29a9 Bytes 40 Record 0001
Seem 29b2 Bytes 30 Record 0001
Seem 29b3 Bytes 30 Record 0001
Seem 29b6 Bytes 20 Record 0001
Seem 29ba Bytes 60 Record 0001
Seem 29bb Bytes 60 Record 0001
Seem 29bc Bytes 40 Record 0001
Seem 29be Bytes 90 Record 0001
Seem 29bd Bytes 90 Record 0001- This one moves the statup sound back to the a/motorola/system folder I'ts up to you if you want to do it as it's still linked to the Moto animation.

____________________________________

9. More MMS Fixes part 3

From Goldmembr.... http://www.howardforums.com/showpost.php?p=6841197&postcount=299

Ok here is the final seem edit to have Send To PixPlace Fully working without having to manualy type in the email address. You must do all the individual seem edits i posted in this thread post #228
Note: You MUST open this seem and put in your "10 digit number" because right now what it says is "9999999999@pix.vtext.com" so change "9999999999" to "your10digitnumber" and leave the spaces between the numbers.

Seem 29a0 Bytes 40 Record 0001

29a0_0001.rar
 

____________________________________

10. Fix 1x and EVDO Data...

This has been slightly re-worked to fit the flow of this guide... i.e. the mentions of files that you need to backup while still on the VERIZON Firmware have been removed from this section, but added to the backup section in the beginning, and file links moved "in-line" so there is not a problem with the rapid share links going away...

NOTE: if you can't get the nvm/cdma_sec  backed up, you can use your backed up Seem 01d2.

From jlbrightbill -> http://www.howardforums.com/showpost.php?p=8511617&postcount=346

NOTE #2: Many reports have said this guide only results in working data after doing using the ESN changer to reprovision data OR calling CS to get it reprovisioned that way. Once data is working completely over 1X, move on to this next step.

1. Open your backup of cdma_sec in a hex editor, I personally use Hex Workshop, but Winhex or others will work as well. Use the instructions contained in these two images to copy your HA Shared Secret and AAA Shared Secret keys.

hasharedsecretme6.png
aaasharedsecretse5.png

Of course on your particular backup the string won't be all A's and all B's, I used them to clearly point out exactly what you're looking for.

2. Open QPST's Service Programming and select "Load from Phone"
3. Move to the MIP tab, and select the User Profile that contains your10digit#@vzw3g.com, then hit Edit
3. Select "Enter hex value" on both HA Shared Secret and AAA Shared Secret.
4. Paste the two strings you copied before into the proper location, hit OK, then write to phone. Once these are written the two fields will switch back to "Retain last value" if you read from phone again, but the strings will be written to cdma_sec so "Retain last value" means it will use them.
5. Copy 10.key  to /DMU/

EVDO data should work now.

Because EVDO data should be working, if you disabled it before, you can re-enable it... 

____________________________________

11. Fixing VCAST
COPIED FROM THE WIKI
Fixing VCAST

Download and extract the zip file from vast_brew_preloads.zip
Connect to the phone using PST
Use P2kCommander and navigate to /a/brew/mod
Create two folders named '13478' and '12513'
Copy the files from the '13478' and '12513' folders from the zip file to these folders respectively
Create the folder /a/brew_preloads (at the root)
Copy 13478.mif and 12513.mif from the zip into that
Restart the phone.
____________________________________

My Final Notes.... 

Now that everything is working, Please create new QPST,  PST and SEEM backup files (as outlined earlier)... It will make it easier to recover should something mess up your Alltel firmware.

There is still discussion as to whether *228 will corrupted data services when using the Alltel MONSTER firmwares.  So it is up to you..  Take a chance updating your PRL by using *228 opt 2 , or just manually update using PST from now on.