Current version: 3.8.0 [changelog]

Date: 22-Nov-2011

  Download Demo

  GetHardwareID software

CDMA Workshop is a professional universal and all-in-one service software, developed to work with any CDMA 450/800/1900/EVDO(1xEVDO)/etc phones, smart phones, fixed terminals, data cards/modems based on any Qualcomm chipsets. It is the necessary tool for easy and fast programming or re-programming CDMA phones to any network, making clones, unlocking, reading and changing ESN and MEID, security codes, such as: user lock, SPC, MSL, FSC, OTKSL, Minlock, etc.. authentication security codes, such as: A-key, SSD_A, SSD_B.. and many many other things. CDMA Workshop combines all major functions and operations which are necessary for full-functional work with CDMA phones and it is a «must have» software for every serious technician, cellular/repair shops and dealers.

Supported Windows: Win 95/98/ME, NT, 2000, XP, 2003, Vista, Windows 7 (x32 and x64)

Supported Interfaces: COM (serial), USB, USB-to-COM converters, any kind of Uniboxes

"Main" tab  -  screen shot | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18

In order to program phones to a necessary network you need write network settings, such as: MCC, MNC, SID-NID pairs, Primary/Secondary channels, etc. You can write these parameters on this tab, as well as read existing settings from any worked already programmed phone and create your own collection of network settings for each network you necessary. You can read/write and change any other settings related with Qualcomm mobile devices, such as: EVDO, Data, R-UIM, AMPS, GSM, Multimedia, gpsOne, Timers, IPv6, RmNet, IWLAN, eHRPD.

This programming engine has been specially optimized for users who are programming a lot of phones every day and want to get maximally speedy, convenient, and functional solution. CDMA Workshop makes your life easy and work effective.

Furthermore, CDMA Workshop is able to calculate "not programmed" True IMSI value. If True IMSI is not used in your network as one of the authentication parameter, then you need to write a special value of True IMSI, called "not programmed". This value is based on current ESN (pESN), they must be matching each other. Thus, if you changed ESN or MEID, then do not forget to re-calculate "not programmed" IMSI value to correctly program your device.

"Memory" tab  -  screen shot | 2

  • Read/Write/Scan  -  at first, you can scan memory by using the "Scan Memory" function, in order to get a memory map and find readable addresses of memory. After that, you can use these found readable addresses in Read/Write functions and in "Universal RAM" methods ("ESN", "MEID, "SPC", "Cave" sections.. see below).

  • "NV-items" section  -  you can backup/restore any amount of NV-items in this section. Doing so you can backup/restore all phone settings: user settings, network settings, security settings, RF calibrations, etc. Also, CDMA Workshop has ability and specially developed by us mechanism to make FULL backup of NV-items for models which restart at trying of access to some of NV-items (see details in "nv_skip_list.txt" file).

  • "Flash" section  -  these functions use bootloaders for different MSM chipsets in order to Read/Write flash-memory directly in flash-chip. By using these functions you can create your own collection of full-flashes and use them to upgrade firmware, as well as to repair phones with "software" problems (corrupted EFS, etc). Supported chipsets: MSM 3000-5500, 5100, 6000, 6025/6050, 5105/5500/6000 (ZTE / Axesstel).

  • Hiewer  -  this is full-functional Hex memory viewer and editor. You can browse, investigate phones memory in visual manner and even edit phones RAM, EEPROM, and NV-items directly in real-time.

"Security" tab  -  screen shot

  • "SPC" section  -  you can read/write and send SPC (Service Provider Code) unlock code to a phone here.

All CDMA phones are locked by using of SPC. You must unlock phone by using "SPC - Send" button, before writing: network settings, PRL, NV-items, etc. CDMA Workshop will show a notification message automatically if a phone require SPC to be entered before such operations. Once phone is unlocked you can change SPC to any other value you want.

  - "Universal RAM" method can search and extract all 6-digit security codes (SPC, MSL, FSC, Minlock, etc) directly from RAM memory. Security codes always located somewhere in RAM memory. This method is very powerful and used for models for which security codes cannot be read by the other methods: models which have no any EFS support, old models or models which use locked EFS. (ex. all new Sanyo models, HTC, BlackBerry, Treo/Palm models, Sierra AirCards, Novatel modems, etc)

  - "Universal EFS" method will work on the majority modern and old models based on any version of EFS and read all 6-digit and 4-digit (user lock) security codes.

  - "Default (nv_read)" - the standard method. Allow to read SPC in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, Sierra modems, and especially Samsung models including newest Android models.

  - "LG method" - you can read SPC on most LG models by using this method.

  - "HTC method" - you can read SPC on most HTC models including newest Android models (ex. HTC-6700, 6800, 6850, 6900, 6950, Touch Pro 2, Evo 4G, Evo 3D, etc) and Palm Treo 850 Pro (HTC based).

  - "Motorola method" - this method is universal for many Motorola models. You can use this method to read SPC, MSL, and user lock for many Motorola models with "syn_feature" file in EFS (ex. C290, V710, E815, V3c, V3m, K1m, V9m, and many other models (non-locked EFS only)).

  - "C-motech method" - you can read SPC on many of C-motech modems by using this method (ex. C-motech CDU650, CDU680, etc).

  - "SonyEricsson" - you can read SPC on all SonyEricsson models by using this method (ex. SonyEricsson T606, T608, etc).

  - "Kyocera Minlock (SPC3)" - this is a universal automatic method, used to read Minlock unlock code (also known as SPC3) on Kyocera models based on EFS1 (ex. KX1, KX4x4 / KE4x4, SE44, SE47, etc). For newer Kyocera models you can use "Universal RAM" and "Universal EFS" methods to read SPC3.

  - "Direct EEPROM" - this method is quite similar "Universal RAM" method, but designed to work with EEPROM. Sometimes security codes are located in EEPROM (ex. old models, old Samsung models, all LG models, etc).

P.S. The other available methods of reading SPC, please check in Demo version.

  • "ESN" section  -  you can change ESN (Electronic Serial Number) here. This function is useful for repair damaged ESN or write new one in order to make clone phones.

  - "Universal RAM" method will search all ESN addresses in RAM memory and save them to a file, after that it will use these addresses to write new ESN directly. This method is very useful to use and must be used for brands and models for which ESN cannot be changed by the other methods, such as: Epsilon, Compal, Aiko, ZTE, Axesstel, Novatel data cards, HTC, BlackBerry, Treo/Palm models, some of Samsung M-series, and many other brands and models.

  - "Universal EFS" method will work on the majority modern models based on non-locked EFS2 (Embedded File System), such as: latest Samsung Sprint/Verizon models,  Treo 700, 755, etc, Audiovox/UtStarcom models (ex. 6600, 6700, 120sp, 7025sp, etc), Kyocera new models, new LG models, korean Samsung SCH-V, S-series, Motorola MS-series (ex. MS400, MS500, etc), ZTE phones/data cards, and many other brands and models.

  - "Universal EFSx" method has the same power and universality as "Universal EFS" method above, but intended for newer CDMA devices based on new type of structure of EFS. For example it worked just fine for Sierra Wireless modems (ex. Sierra 598U, etc), Pantech modems (ex. Pantech UM175, UM185, UMW190, UML290, etc), wide range of different Samsung models, M, U, I-series (ex. Samsung SPH-M800, M810, M820, M900, M910, U820, D700 Galaxy S Epic 4G, D710 Galaxy S2, D720 Nexus S, P100 Galaxy Tab, etc), and much more.

  - "Default (nv_write)" - the standard method. Allow to change ESN in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, and especially Samsung models including newest Android models.

  - "Kyocera method" - this method is developed to work with Kyocera models based on MSM chipsets up to MSM5100 (ex. 2035, 2135, 3035, 3245, 5135, 7135, S14, 1135/1155, 2235/2255, 2325/2345, SE44/SE47, Blade/Phantom, etc). For newer Kyocera models you can use "Universal EFS" method.

  - "LG method" - you can write new ESN on most LG (including newest) models by using this methods.

  - "HTC method" - you can write new ESN on most HTC models including newest Android models (ex. HTC-6950, XV6975, Evo 4G, Evo 3D, Incredible, Incredible 2, Thunderbolt, etc) and Palm Treo 850 Pro (HTC based).

  - "Sanyo method" - you can write new ESN on Sanyo models up to Sanyo 8300 by using this method (ex. Sanyo 4900, 5300, 5400, 5500, 7200, 7300, 8100, 8200, etc).

  - "UTStarcom method" - you can write new ESN for many of UTStarcom models by using this method (ex. CDM-7000, 7025, 7050, 105, 120, 180, etc). This method is useful when "Universal EFS" method does not work.

  - "Sierra Wireless cards method" - you can write new ESN on most Sierra Wireless modems by using this methods (ex. AC580/Audiovox PC5220, 595, 597/MC5725, 598, etc).

  - "Huawei EC-series method" - you can write new ESN on Huawei EC-series modems by using this method (ex. Huawei EC168, EC228, EC360, etc).

  - "C-motech method" - you can write new ESN on C-motech modems by using this method (ex. C-motech CDU650, CDU680, etc).

  - "ZTE / Axesstel method" - you can write new ESN on models based on MSM5105, 5500, 6000 chipset (ex. C100, 150, 160, 170, 180, 190, 200, 201, 202, 204, 220, 230, 231, 401, 631, 632, 705, etc, etc. Nokia 1255). You can use this method to write new ESN on many Axesstel models also (ex. P800, L800, L1900, etc).

  - "VK Mobile" - you can write new ESN on most VK_Mobile models by using this method (ex. VK-100c, 200c, 220c, 300c, 600c, 650c, x100, 700c, etc).

  - "Samsung EsnDev" - this method is used for Samsung models for Korean, Asia and Oceania, Israeli, etc markets, such as: SCH-X, E-series, some V-series and some A-series (ex. a562).

Some brands and models use encrypted ESN inside and/or hide real ESN and do not allow to read real ESN by standard methods (ex. all Samsung SCH-V, S, B-series, Motorola MS-series, korean market LG models, etc). You can use "Real ESN" option to read real ESN for such models. This method is Universal and can be used on any CDMA models.

You can see ESN prefix (ESN owner or phone manufacturer) in pop-up hint by moving mouse cursor to the ESN field here also. This feature is very useful to see - is the current ESN original or it already has once been changed.

P.S. The other available methods of changing ESN, please check in Demo version.

  • "MEID" section  -  you can enable/disable and change MEID (Mobile Equipment IDentifier) here. When a device is MEID-based, then ESN is called pESN (pseudo ESN, for backward compatibility purposes) and pESN must be matching current MEID.

CDMA Workshop will check pESN and MEID matching at first reading of phone and show a notification message automatically if pESN and MEID is not matching each other. CDMA Workshop will automatically re-calculate and write correct pESN at changing MEID with using available methods. You can even disable using MEID, in order to use MEID-based phones in ESN-based networks.

  - "Universal RAM" method has the same principle of work as "Universal RAM" method in "ESN" section, but designed to work with MEID-based phones. For example it worked just fine for many of HTC models.

  - "Universal EFS" method will work on the majority modern models based on non-locked EFS2, such as: Samsung, Kyocera, UTStarcom models, etc.

  - "Universal EFSx" method has the same power and universality as "Universal EFS" method above, but intended for newer CDMA devices based on new type of structure of EFS. For example it worked just fine for Sierra Wireless modems (ex. Sierra 598U, etc), Pantech modems (ex. Pantech UM175, UM185, UMW190, UML290, etc), wide range of different Samsung models, M, U, I-series (ex. Samsung SPH-M800, M810, M820, M900, M910, U820, D700 Galaxy S Epic 4G, D710 Galaxy S2, D720 Nexus S, P100 Galaxy Tab, etc), and much more.

  - "Default (nv_write)" - the standard method. Allow to change MEID/pESN in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, and especially Samsung models including newest Android models.

  - "LG method" - you can write new MEID/pESN on most LG models (MEID-based) by using this method.

  - "HTC method" - you can write new MEID/pESN on most HTC models including newest Android models (ex. HTC-6950, XV6975, Evo 4G, Evo 3D, Incredible, Incredible 2, Thunderbolt, etc) and Palm Treo 850 Pro (HTC based).

  - "Huawei EC-series method" - you can write new MEID/pESN on Huawei EC-series modems by using this method (ex. Huawei EC168, EC228, EC360, etc).

Some brands and models use encrypted MEID inside and/or hide real MEID and do not allow to read real MEID by standard methods. You can use "Real MEID" option to read real MEID for such models. This method is Universal and can be used on any CDMA models (MEID-based).

  • "Passwords (16 digits)" section  -  some brands and models are protected by special internal security password (16 digits). You must send a valid password by using "Send" button for such models, in order to unlock changing ESN, MEID/pESN, reading SPC/A-key by using "Default" methods, as well as reading/writing RAM/EEPROM memory, etc

For example Kyocera, Sanyo, LG, etc do not use this kind of protection in their models. Samsung Sprint models use the same password in all their models, it is called "Samsung (default)" in the list of passwords. The same password is used in many other Samsung models for other networks, countries and regions (Latin America, Asia and Oceania, etc). Also, you have opportunity to add very easily your own passwords to the general list of passwords, upgrade and create your own custom list of passwords.

  • "User Lock" section  -  you can read/write 4-digit user lock here, as well as enable and disable it.

"CAVE" tab  -  screen shot

  • "CAVE" section  -  the A-key is used in many CDMA networks in authentication process (besides a basic authentication parameters - ESN (MEID) and phone number), in order to avoid cloning. Security of the A-key is critical in such CDMA systems. To make clone phones, A-key, SSD_A (SSD_B) must be also programmed in such networks. You can read original CAVE (Cellular Authentication and Voice Encryption) keys and write new ones on this tab.

  - "Universal EFS" method will read authentication keys on the majority modern and old models based on any version of EFS.

  - "Universal RAM" method can search and extract authentication keys directly from RAM memory. Authentication keys always located somewhere in RAM memory. This method is used for models for which authentication keys cannot be read by the other methods: models which have no any EFS support, old models or models which use locked EFS.

  - "Default (nv_read)" - the standard method. Allow to read authentication keys in many cases once your phone is unlocked with using internal security password (see list of passwords in "Passwords (16 digits)" section). It is used for wide range of different brands and models, such as: Audiovox, Hyundai, Sky, Pantech, Sierra modems, and especially Samsung models including newest Android models.

  - "LG method" - you can read authentication keys on most LG models by using this method.

  - "Novatel modems" - you can write (non-standard algorithm) new authentication keys on all Novatel modems by using this method (ex. Novatel U720, V720, S720, EX720, U727, U760, MiFi2200, etc).

  - "UTStarcom method" - you can read authentication keys on many of UTStarcom models by using this method (ex. CDM-7000, 7025, 7050, 105, 120, 180, etc).

  - "SonyEricsson method" - you can read authentication keys on all SonyEricsson models by using this method.

  • "A-key chksm calculator" section  -  you can generate a valid 6-digit checksum for A-key, in this section. This is sometimes required for testing the phone's A-key entry function, as well as for the phone's activation. It used to be possible to obtain a valid A-key with checksum only from the cellular operator itself, now everyone can easily generate the secret checksum value, enter those numbers into the phone just using the phone's keypad. When you want to program the new A-key into the phone over the keypad, you must enter 26 digits (20 digits A-key in Dec + 6-digit checksum).

"Other" tab  -  screen shot

• "PRL" section - you can read and write PRL files (Preferred Roaming List) here.

  - "Read" - you can read PRL from any existing worked phone and create your own collection of PRL files for each network you necessary.

  - "Write" - use available methods to write PRL: Universal method for most CDMA phones, LG and Sanyo methods (non-standard) specially for LG and Sanyo models.

You can make a rebuild of all internal settings/EFS on this tab also. "Default (Samsung)" method was designed for Samsung models only, but this method, as based on standard Qualcomm algorithms, is working and may work for many other brands and models also, such as: Withus, Epsilon, Compal, Audiovox, etc. Just try it on your models, it may work. Sanyo method will Reset/Rebuild EFS for new models started from Sanyo 8300, it will also open locked EFS and reset all security codes to default values. Rebuild EFS is necessary in order to change ESN on new Sanyo models also. Huawei EC-series method will do full rebuild, all settings will be reset (SPC, ESN, MEID, network settings, etc). Universal EFSx method one more newest powerful method which will do full rebuild (network settings, PRL, A-key, serial and security codes, etc) for almost all brands and models where "Universal EFSx" methods to change MEID/ESN are working (see above, Samsung models, Pantech modems, etc).

"Terminal" tab  -  screen shot

This is CDMA low-level terminal for advanced users, which allow you to send Qualcomm DM commands and receive answers from a handset in Hex and ASCII format. It is useful in different investigations and custom situations, for example it allow you to repair damaged SPC, when a handset does not accept any SPC (because it is damaged inside a handset, consists not only of one digits). It has a counter of total amount of bytes in packets (commands), automatic CRC calculation and commands history, in order to facilitate usage.

You also have opportunity to create and run scripts with AT and DM commands. If you have some knowledge and know AT modem or especially Qualcomm DM commands, then you can embody your own actions or algorithms which even are not present in CDMA Workshop.

"Monitor" tab  -  screen shot | 2 | 3 | 4 | 5

The "Real-time network monitor" function is allow you to observe online/offline phone activity and status. This function is very useful to finding and solving problems with non-correct phone programming, when a phone cannot make calls or cannot find network.

By purchasing a software you will receive:

Full functional software, unlimited use.

Your personal or company registration key for one PC.

Ability to activate/deactivate your license and to move software to any other PC you want.

Ability to upgrade your current PC with new components and get a new license key.

A special account to download the new versions of software. This account will expire in 12 months.

No shipping (downloadable from our site)

Lifetime e-mail technical support.

** You also have opportunity to re-sell used copies of CDMA Workshop. The copy will be fully re-registered to a new person or company.

CDMA Workshop is always in a development stage and adding new features and algorithms, we are working hard on every new version and we shall gladly accept and consider your custom requests, suggestions, ideas or bug reports in order to make CDMA Workshop more powerful.

CDMA Workshop cost 99$ only

You can buy complete CDMA solution with discount