Current version: 3.9.0 [changelog] [user_panel] [support_forum]

Date: 09-Dec-2012

  Download Demo

  GetHardwareID software

  Free NV-items reader_writer

CDMA Workshop is a professional, universal, and all-in-one service software, developed to work with any CDMA 450/800/1900/1xEVDO/WCDMA/GSM/UMTS/HSDPA/LTE, etc phones, smart phones, fixed terminals, data cards/modems based on any Qualcomm and compatible chipsets. It is the necessary tool for easy and fast programming or re-programming (flashing) CDMA devices to any network, unlocking, repair ESN, MEID, IMEI.. security codes, such as: user lock, SPC, MSL, FSC, OTKSL, Minlock, SIM-lock, etc.. authentication security codes, such as: A-key, SSD_A, SSD_B keys.. Bluetooth, WiFi MAC addresses.. and many many other things. CDMA Workshop combines all major functions and operations which are necessary for full-functional work with CDMA devices and it is a «must have» software for every serious technician, cellular/repair shops and dealers. Strongly recommended.

Supported Windows: Win 95/98/ME, NT, 2000, XP, 2003, Vista, Windows 7, Windows 8 (x32 and x64)

Supported Interfaces: COM (serial), USB, USB-to-COM converters, any kind of Uniboxes

Additional built-in unlimited unlock codes calculators and tools in CDMA Workshop ->

"Main" tab  -  screen shot | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24

In order to program phones to a necessary network you need write network settings, such as: MCC, MNC, SID-NID pairs, Primary/Secondary channels, etc. You can write these parameters on this tab, as well as read existing settings from any worked already programmed phone and create your own collection of network settings for each network you necessary. You can read/write and change any other settings related with Qualcomm mobile devices, such as: EVDO, Data, R-UIM, AMPS, GSM, Broadcast SMS, SMS-CB, SMS, Multimedia, gpsOne, Timers, IPv6, RmNet, IWLAN, eHRPD.

This professionally made flashing engine has been specially optimized for users who are programming a lot of devices every day and want to get maximally speedy, convenient, and functional solution. It does not have any restrictions and it is more powerful than even native Qualcomm software. CDMA Workshop makes your life easy and work effective.

Furthermore, CDMA Workshop is able to calculate "not programmed" True IMSI value (only for CDMA Workshop users). If True IMSI is not used in your network as one of the authentication parameter, then you need to write a special value of True IMSI, called "not programmed". This value is based on current ESN (pESN), they must be matching each other. Thus, if you changed ESN or MEID, then do not forget to re-calculate "not programmed" IMSI value to correctly program your device.

"Memory" tab  -  screen shot | 2

 • Read/Write/Scan  -  at first, you can scan memory by using the "Scan Memory" function, in order to get a memory map and find readable addresses of memory. After that, you can use these found readable addresses in Read/Write functions and in "Universal RAM" methods ("ESN", "MEID, "SPC", "Cave" sections.. see below).

  - "EFS_RAW" - method can read EFS in low-level RAW format, sector by sector, but not as a regular list of files and directories. Mostly, this function is very useful to extract, from the resulting dump, security codes, authentication keys, EVDO logins/passwords, etc, while regular access to system files in EFS is locked by manufacturer. You can use very useful built-in "Keyboard codes searcher" tool for such purposes. Many brands and models allow reading EFS in low-level RAW format, such as: wide range of LG, Samsung, Kyocera, Motorola, Palm models, Huawei, Sierra, C-motech, Franklin modems, MDM9600 (HTC), etc. All "EFS_RAW" methods in CDMA Workshop support and automatically detect both standard and Alternate ways to access to EFS_RAW. As a result, you will additionally be able to operate with more devices where "Alternate" way is used, for example: Huawei 3G Mobile WiFi (MiFi) E585, E5832, E5830, E583C, etc.

  - "RAM_3A" - the access type to a memory which is only available in Download Mode and in devices with download protocol version 6 or greater. This method is mostly supported by newer devices, just for example: Novatel modems/routers PC770, C777 (Merlin), U720, U727, U760, MiFi2200, etc.. Huawei M635, M735.. Kyocera S3015 Brio.. GSM phones Sony XPeria X2, LG Optimus Elite, etc). You can use this method and then extract SPC, EVDO logins, passwords, etc from the resulting dump using "Keyboard codes searcher".

 • "NV-items" section  -  you can backup/restore any amount of NV-items in this section. Doing so you can backup/restore all phone settings: user settings, network settings, security settings, RF calibrations, etc. Also, CDMA Workshop has ability and specially developed by us mechanism to make FULL backup of NV-items for models which restart at trying of access to some of NV-items (see details in "nv_skip_list.txt" file).

 • "Flash" section  -  these functions use bootloaders for different MSM chipsets in order to Read/Write flash-memory directly in flash-chip. By using these functions you can create your own collection of full-flashes and use them to upgrade firmware, as well as to repair phones with "software" problems (corrupted EFS, etc). Supported chipsets: MSM 3000-5500, 5100, 6000, 6025/6050, 5105/5500/6000 (ZTE / Axesstel).

 • Hiewer  -  this is full-functional Hex memory viewer and editor. You can browse, investigate phones memory in visual manner and even edit phones RAM, EEPROM, and NV-items directly in real-time.

"Security" tab  -  screen shot

 • "SPC" section  -  you can read/write and send SPC (Service Provider Code) unlock code to a device here.

All CDMA phones are locked by using of SPC. You must unlock phone by using "SPC - Send" button, before writing: network settings, PRL, NV-items, etc. CDMA Workshop will show a notification message automatically if a phone require SPC to be entered before such operations. Once phone is unlocked you can change SPC to any other value you want.

  - "Universal RAM" method can search and extract all 6-digit security codes (SPC, MSL, FSC, Minlock, etc) directly from RAM memory. Security codes always located somewhere in RAM memory. This method is very powerful and used for models for which security codes cannot be read by the other methods: models which have no any EFS support, old models or models which use locked EFS. (ex. all new Sanyo models, HTC, BlackBerry, Treo/Palm models, Sierra AirCards, Novatel modems, etc)

  - "Universal EFS" method reads security codes directly from EFS system files. It automatically detects and supports both access types EFS1 and EFS2, both structures of system files in EFS, older and newer, all known possible locations. It will read all 6-digit (SPC, FSC, OTKSL, etc) and 4-digit (user lock) security codes. Also, if you did some research and know where (in which EFS file) security codes are located for specific model or series, then you can add your own custom EFS paths to the list where «Universal EFS» method will search security codes (see "spc_efs_paths.txt" file for more details).

  - "Universal EFS_RAW" method - one more powerful universal fully automated method. Manufacturers in newer models may lock regular access to system files in EFS (where security codes are located) and access to a RAM memory so the above universal methods will not work, but we still have a chance to read EFS in low-level RAW format, sector by sector, and extract SPC from the resulting dump. You can use this method for wide range of different brands and models, just for example: LG VN150PP, VX5600PP, VX8550, VX9700.. Kyocera E2000, K433L, K494L.. Audiovox 8945.. BlackBerry 8703e, 8830we.. Palm Treo 800w, Centro.. Samsung A700, M500, R500, R560, U360, U640.. Huawei M635, M735.. modems Huawei EC122, EC156, EC168, EC228, EC360.. Franklin U210, U300, U600 (C-motech, Sprint).. Sierra 250U, 597, 598U.. Cal-Comp A600.. MDM9600 part of LTE HTC models Thunderbolt, Rezound.. and much more.

  - "Universal RAM_3A" - this method is mostly supported by newer devices. For example, you can use this method on: Novatel PC770 (Merlin), C777, U727, U760, MiFi2200, etc.. Huawei M635, M735.. Kyocera S3015 Brio, etc.

  - "Default (nv_read)" - the standard method. Allow to read SPC in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, Sierra modems, and especially Samsung models including newest Android models.

  - "LG method" - you can read SPC on most LG models by using this method.

  - "HTC method" - you can read SPC on most HTC models including newest Android models (ex. HTC-6700, 6800, 6850, 6900, 6950, Touch Pro 2, Evo 4G, Evo 3D, Thunderbolt, Rezound, etc) and Palm Treo 850 Pro (HTC based).

  - "Motorola method" - this method is universal for many Motorola models. You can use this method to read SPC, MSL, and user lock for many Motorola models with "syn_feature" file in EFS (ex. C290, V710, E815, V3c, V3m, K1m, V9m, and many other models (non-locked EFS only)).

  - "C-motech method" - you can read SPC on many of C-motech (Franklin) modems by using this method (ex. C-motech U300, CDU-550, CDU-650, CDU-680, etc).

  - "SonyEricsson" - you can read SPC on all SonyEricsson models by using this method (ex. SonyEricsson T606, T608, etc).

  - "Kyocera Minlock (SPC3)" - this is a universal automatic method, used to read Minlock unlock code (also known as SPC3) on Kyocera models based on EFS1 (ex. KX1, KX4x4 / KE4x4, SE44, SE47, etc). For newer Kyocera models you can use "Universal RAM" and "Universal EFS" methods to read SPC3.

  - "Direct EEPROM" - this method is quite similar "Universal RAM" method, but designed to work with EEPROM. Sometimes security codes are located in EEPROM (ex. old models, old Samsung models, all LG models, etc).

P.S. The other available methods of reading SPC, please check in Demo version.

 • "ESN" section  -  you can change ESN (Electronic Serial Number) here. This function is useful to repair damaged ESN.

  - "Universal RAM" method will search all ESN addresses in RAM memory and save them to a file, after that it will use these addresses to write new ESN directly. This method is very useful to use and must be used for brands and models for which ESN cannot be changed by the other methods, such as: Epsilon, Compal, Aiko, ZTE, Axesstel, Novatel data cards, HTC, BlackBerry, Treo/Palm models, some of Samsung M-series, and many other brands and models.

  - "Universal EFS" method will work on the majority modern models based on non-locked EFS2, such as: Samsung A700, M300, M500, R500, U410, U540, etc..  Treo 700, 755, etc.. Audiovox/UtStarcom 6600, 6700, 120, 7025, etc.. Kyocera K433L (K9), K494, KPC680 EVDO modem, etc, LG models, korean Samsung SCH-V, S-series, Motorola MS-series (ex. MS400, MS500, etc), ZTE phones/data cards, and many other brands and models.

  - "Universal EFSx" method has the same power and universality as "Universal EFS" method above, but intended for newer CDMA devices based on newer type of structure of EFS. It will work for wide range of different brands and models, just for example: Sierra 250U, 598U, etc.. Pantech UM175, UM185, UMW190, UML290, etc.. Samsung SPH-M800, M810, M820, M900, M910, U820, D700 Galaxy S Epic 4G, D710 Galaxy S2, D720 Nexus S, P100 Galaxy Tab, etc.. Huawei M635, M735, etc, and much more other devices.

  - "Default (nv_write)" - the standard method. Allow to change ESN in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, and especially Samsung models including newest Android models.

  - "Kyocera method" - this method is developed to work with Kyocera models based on MSM chipsets up to MSM5100 (ex. 2035, 2135, 3035, 3245, 5135, 7135, S14, 1135/1155, 2235/2255, 2325/2345, SE44/SE47, Blade/Phantom, etc). For newer Kyocera models you can use "Universal EFS" method.

  - "LG method" - you can write new ESN on most LG (including newest) models by using this methods.

  - "HTC method" - you can write new ESN on most HTC models including newest Android models (ex. HTC-6950, XV6975, Evo 4G, Evo 3D, Incredible, Incredible 2, Thunderbolt, Rezound, etc) and Palm Treo 850 Pro (HTC based).

  - "Sanyo method" - you can write new ESN on Sanyo models up to Sanyo 8300 by using this method (ex. Sanyo 4900, 5300, 5400, 5500, 7200, 7300, 8100, 8200, etc).

  - "UTStarcom method" - you can write new ESN for many of UTStarcom models by using this method (ex. CDM-7000, 7025, 7050, 105, 120, 180, etc). This method is useful when "Universal EFS" method does not work.

  - "Sierra Wireless cards method" - you can write new ESN on most Sierra Wireless modems by using this methods (ex. AC580/Audiovox PC5220, 250U, 595, 597/MC5725, 598U, etc).

  - "Huawei EC-series method" - you can write new ESN on Huawei EC-series modems by using this method (ex. Huawei EC122, EC156, EC168, EC228, EC360, etc).

  - "C-motech method" - you can write new ESN on C-motech (Franklin) modems by using this method (ex. C-motech CDU-550, CDU-650, CDU-680, etc).

  - "ZTE / Axesstel method" - you can write new ESN on models based on MSM5105, 5500, 6000 chipset (ex. C100, 150, 160, 170, 180, 190, 200, 201, 202, 204, 220, 230, 231, 401, 631, 632, 705, etc, etc. Nokia 1255). You can use this method to write new ESN on many Axesstel models also (ex. P800, L800, L1900, etc).

  - "VK Mobile" - you can write new ESN on most VK_Mobile models by using this method (ex. VK-100c, 200c, 220c, 300c, 600c, 650c, x100, 700c, etc).

  - "Samsung EsnDev" - this method is used for Samsung models for Korean, Asia and Oceania, Israeli, etc markets, such as: SCH-X, E-series, some V-series and some A-series (ex. a562).

Some brands and models use encrypted ESN inside and/or hide real ESN and do not allow to read real ESN by standard methods (ex. all Samsung SCH-V, S, B-series, Motorola MS-series, korean market LG models, etc). You can use "Real ESN" option to read real ESN for such models. This method is Universal and can be used on any CDMA models.

You can see ESN prefix (ESN owner or phone manufacturer) in pop-up hint by moving mouse cursor to the ESN field here also. This feature is very useful to see - is the current ESN original or it already has once been changed.

P.S. The other available methods of changing ESN, please check in Demo version.

 • "MEID" section  -  you can enable/disable and repair MEID (Mobile Equipment IDentifier) here. When a device is MEID-based, then ESN is called pESN (pseudo ESN, for backward compatibility purposes) and pESN must be matching current MEID.

CDMA Workshop will check pESN and MEID matching at first reading of a phone and show a notification message automatically if pESN and MEID are not matching each other. CDMA Workshop will automatically re-calculate and write correct pESN at changing MEID with using available methods. You can even disable using MEID, in order to use MEID-based phones in ESN-based networks.

  - "Universal RAM" method has the same principle of work as "Universal RAM" method in "ESN" section, but designed to work with MEID-based phones. For example it worked just fine for many of Palm, HTC, Blackberry models (ex. Palm Treo 800w, Centro, Pre, Pixi.. HTC 6950 Diamond.. Blackberry 9530,  etc).

  - "Universal EFS" method will work on the majority modern models based on non-locked EFS2, such as: Samsung, Kyocera, UTStarcom models, etc.

  - "Universal EFSx" method has the same power and universality as "Universal EFS" method above, but intended for newer CDMA devices based on new type of structure of EFS. It will work for wide range of different brands and models, just for example: Sierra 250U, 598U, etc.. Pantech UM175, UM185, UMW190, UML290, etc.. Samsung SPH-M800, M810, M820, M900, M910, U820, D700 Galaxy S Epic 4G, D710 Galaxy S2, D720 Nexus S, P100 Galaxy Tab, etc.. Huawei M635, M735, etc, and much more other devices.

  - "Default (nv_write)" - the standard method. Allow to change MEID/pESN in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, and especially Samsung models including newest Android models.

  - "LG method" - you can write new MEID/pESN on most LG models (MEID-based) by using this method.

  - "HTC method" - you can write new MEID/pESN on most HTC models including newest Android models (ex. HTC-6950, XV6975, Evo 4G, Evo 3D, Incredible, Incredible 2, Thunderbolt, Rezound, etc) and Palm Treo 850 Pro (HTC based).

  - "Huawei EC-series method" - you can write new MEID/pESN on Huawei EC-series modems by using this method (ex. Huawei EC122, EC156, EC168, EC228, EC360, etc).

Some brands and models use encrypted MEID inside and/or hide real MEID and do not allow to read real MEID by standard methods. You can use "Real MEID" option to read real MEID for such models. This method is Universal and can be used on any CDMA models (MEID-based).

 • "IMEI" section  -  The methods below to repair IMEI work absolutely in the same manner as the same methods in "MEID" section, but just changed to operate with IMEI instead of MEID. We do not have enough GSM devices for testing, let us us know please where (on which models) these methods have worked and where not.

  - "Default (nv_write)" - Regular "nv_write" command. In many cases sending correct 16-digit security password will allow you to use this method (ex. Pantech UMW190, UML290 3G modems, Samsung U810, etc).

  - "LG method" - tested on LG VL600 4G LTE modem.

  - "Universal EFSx" - tested on Pantech UMW190, UML290 3G modems, HTC 4G Thunderbold.

 • "Passwords (16 digits)" section  -  some brands and models are protected by special internal security password (16 digits). You must send a valid password by using "Send" button for such models, in order to unlock changing ESN, MEID/pESN, reading SPC/A-key by using "Default" methods, as well as reading/writing RAM/EEPROM memory, etc

For example Kyocera, Sanyo, LG, etc do not use this kind of protection in their models. Samsung Sprint models use the same password in all their models, it is called "Samsung (default)" in the list of passwords. The same password is used in many other Samsung models for other networks, countries and regions (Latin America, Asia and Oceania, etc). Sierra Wireless devices use the same password in all their models (ex. 250U, 580, 595, 595U, 598U, 597/mc5725, pc5220, W801, W802S Mobile Hotspot, etc), it is called "Sierra Wireless cards" in the list of passwords. Also, you have opportunity to add very easily your own passwords to the general list of passwords, upgrade and create your own custom list of passwords.

 • "User Lock" section  -  you can read/write 4-digit user lock here, as well as enable and disable it.

  - "Default (nv_read)" - the standard method. Allow to read user lock on most CDMA models.

  - "SonyEricsson" - specialized for SonyEricsson models method (ex. SonyEricsson T606, T608, etc).

  - "Universal, NV-items" method is actually very useful to read user locks on models which use non-standard location of user lock in NV-items and where "Default (nv_read)" method does not work (ex. Samsung SPH-M300.., SCH-A650, A670.., SCH-R211, R350, R450, R560.., korean market models SCH-X,E,V,S,B-series, chinese Hisense C177, C199, etc).

"CAVE" tab  -  screen shot

 • "CAVE" section  -  the A-key is used in many CDMA networks in authentication process (besides a basic authentication parameters - ESN (MEID) and phone number), in order to avoid cloning. Security of the A-key is critical in such CDMA systems. You can read original CAVE (Cellular Authentication and Voice Encryption) keys and write new ones on this tab.

  - "Universal RAM" method can search and extract authentication keys directly from RAM memory. Authentication keys always located somewhere in RAM memory. This method is used for models for which authentication keys cannot be read by the other methods: models which have no any EFS support, old models or models which use locked EFS.

  - "Universal EFS" method reads CAVE keys directly from EFS system files. It automatically detects and supports both access types EFS1 and EFS2, both structures of system files in EFS, older and newer.

  - "Universal EFS_RAW" method has the same power and universality as "Universal EFS_RAW" method in "SPC" section, will work for the same models, but just intended to read authentication keys A-key, SSD_A, SSD_B instead of security codes. This method uses heuristic algorithms and as a result supports both structures of system files in EFS, older and newer, thus you will be able to operate with even older models also.

  - "Universal RAM_3A" - same as above method.

  - "Default (nv_read)" - the standard method. Allow to read authentication keys in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, Sierra modems, and especially Samsung models including newest Android models.

  - "LG method" - you can read authentication keys on most LG models by using this method.

  - "Novatel/Merlin modems" - you can write (non-standard algorithm) new authentication keys on all Novatel/Merlin modems by using this method (ex. Novatel PC770 (Merlin), U720, V720, S720, EX720, U727, U760, MiFi2200, etc).

  - "UTStarcom method" - you can read authentication keys on many of UTStarcom models by using this method (ex. CDM-7000, 7025, 7050, 105, 120, 180, etc).

  - "SonyEricsson method" - you can read authentication keys on all SonyEricsson models by using this method.

 • "A-key chksm calculator" section  -  you can generate a valid 6-digit checksum for A-key, in this section. This is sometimes required for testing the phone's A-key entry function, as well as for the phone's activation. It used to be possible to obtain a valid A-key with checksum only from the cellular operator itself, now everyone can easily generate the secret checksum value, enter those numbers into the phone just using the phone's keypad. When you want to program the new A-key into the phone over the keypad, you must enter 26 digits (20 digits A-key in Dec + 6-digit checksum). Our A-key checksum calculator supports both ESN and MEID-based (only for CDMA Workshop users) devices (ex. all HTC smartphones).

"Other" tab  -  screen shot | 2 | 3

 • "PRL" section - you can read and write PRL files (Preferred Roaming List) here.

  - "Read" - you can read PRL from any existing worked phone and create your own collection of PRL files for each network you necessary.

  - "Write" - use available methods to write PRL: Universal method for most CDMA phones, LG and Sanyo - non-standard native methods especially for LG and Sanyo models.

 • "Rebuild" section - you can make a rebuild of all internal settings/EFS in this section.

  - "Default (Samsung)" - method was designed for Samsung models only, but this method, as based on standard Qualcomm algorithms, is working and may work for many other brands and models also, such as: Withus, Epsilon, Compal, Audiovox, etc. Just try it on your models, it may work.

  - "Sanyo" - method will Reset/Rebuild EFS for new models started from Sanyo 8300, it will also open locked EFS and reset all security codes to default values. Rebuild EFS is necessary in order to change ESN on new Sanyo models also.

  - "Huawei EC-series" - method will do full rebuild on Huawei EC-series modem (ex. Huawei EC122, EC156, EC168, EC228, EC360, etc), all settings will be reset (SPC, ESN, MEID, network settings, etc).

  - "Novatel/Merlin modems" - method will do full rebuild on many of Novatel/Merlin modems/routers (ex. Novatel S620, S720, PC770, C777 (Merlin), MiFi2200, etc).

  - "Universal EFSx" - method is one more newest powerful method which will do full rebuild (network settings, PRL, A-key, serial and security codes, etc) for almost all brands and models where "Universal EFSx" methods to change MEID/ESN are working (see above, Samsung models, Pantech modems, etc).

 • "Keypad emulator" page - this is a keypad emulator tool.

 • "Display capture" page - this is a display capture tool.

"Terminal" tab  -  screen shot

This is CDMA low-level terminal for advanced users, which allow you to send Qualcomm DM commands and receive answers from a handset in Hex and ASCII format. It is useful in different investigations and custom situations, for example it allow you to repair damaged SPC, when a handset does not accept any SPC (because it is damaged inside a handset, consists not only of one digits). It has a counter of total amount of bytes in packets (commands), automatic CRC calculation and commands history, in order to facilitate usage.

You also have opportunity to create and run scripts with AT and DM commands. If you have some knowledge and know AT modem or especially Qualcomm DM commands, then you can embody your own actions or algorithms which even are not present in CDMA Workshop.

"Monitor" tab  -  screen shot | 2 | 3 | 4 | 5 | 6

The "Real-time network monitor" function is allow you to observe online/offline phone activity and status. This function is very useful to finding and solving problems with non-correct phone programming, when a phone cannot make calls or cannot find network.

By purchasing a software you will receive:

Full functional software, unlimited use.

Your personal or company registration key for one PC.

You will need an internet connection (protection and licensing system).

Ability to activate/deactivate your license and to move software to any other PC you want.

Ability to upgrade your current PC with new components and get a new license key.

A special account to download the new versions of software. This account will expire in 12 months.

No credits or logs, no monthly fee. Fully unlimited solution. Pay once - use lifetime.

No fee for delivery (downloadable from our site).

Lifetime e-mail technical support.

CDMA Workshop is always in a development stage and adding new features and algorithms, we are working hard on every new version and we shall gladly accept and consider your custom requests, suggestions, ideas or bug reports in order to make CDMA Workshop more powerful.

CDMA Workshop cost 108$ only

You can buy complete CDMA solution with discount