[00:02.160 --> 00:07.140]  Today we have The Prophet talking about CDMA PRLs, and I'll let him take it away.
[00:11.160 --> 00:12.800]  Let's see, is this thing on?
[00:15.040 --> 00:15.860]  Okay, excellent.
[00:17.140 --> 00:18.000]  I'm The Prophet.
[00:19.580 --> 00:23.560]  I thought around three people would be here, so I'm a little bit surprised to see you all.
[00:24.860 --> 00:29.180]  CDMA is the dominant mobile phone technology used in North America.
[00:29.180 --> 00:37.100]  I know there's a lot of people here from on the other side of the Atlantic, and so I'm hoping there's some representation from there.
[00:37.520 --> 00:41.160]  This will not be useful to you at all if you are a GSM person.
[00:41.420 --> 00:52.780]  So if you have T-Mobile, as in T as in terrible mobile, or AT&T Wireless, or Singular, I guess they're the same company now, sort of.
[00:53.440 --> 00:56.440]  This stuff probably won't be very useful to you.
[00:57.120 --> 01:05.360]  Also, just to do some business items up front, if you want to learn how to make free phone calls, I don't do that anymore.
[01:05.420 --> 01:11.980]  And I haven't, since the statute of limitations expired, whatever that is, if it's not considered terrorism now.
[01:12.120 --> 01:15.820]  So if you're wanting to learn how to make free phone calls, this is not the right place.
[01:15.820 --> 01:31.540]  However, if you like to take things apart, and if you want to know what you're really buying when you buy a nationwide service from Verizon, Altel, Sprint, US Cellular, or any other CDMA carrier, then this is the talk for you.
[01:31.540 --> 01:47.400]  And what I'll be demonstrating is how you get a PRL off of a handset, in particular, my Sanyo 7200, after I tell you what a PRL is, of course, and then how you take it apart, and how you look at what's inside.
[01:47.400 --> 01:52.720]  So, without further ado, I hate PowerPoint with a passion.
[01:53.120 --> 01:58.300]  I don't generally use this, but in this kind of venue, there's really no alternative.
[01:58.300 --> 02:00.820]  So, my apologies in advance.
[02:03.720 --> 02:05.400]  So, here we are.
[02:07.620 --> 02:11.080]  Obviously, PRL hacking what your wireless carrier doesn't want you to know.
[02:12.700 --> 02:14.560]  So, what's a PRL?
[02:14.560 --> 02:24.040]  Well, if you're going somewhere like Montana, you really care what a PRL is, because it's what tells your phone where you can use it, essentially.
[02:24.900 --> 02:31.560]  There are a number of wireless carriers that are compatible with your particular handset.
[02:31.880 --> 02:39.740]  This handset in New York City is compatible with Sprint, AT&T, wireless, and with Verizon, for example.
[02:40.600 --> 02:58.660]  And depending which carriers you're allowed to use in whatever area you're in, that has a strong bearing on what the quality of the coverage is going to be that you'll experience, and also what the type of coverage you'll experience is, be it digital or analog.
[02:58.660 --> 03:02.840]  So, you can only use the systems that your carrier specified.
[03:03.540 --> 03:09.300]  And even if other systems are available, if your carrier hasn't specified that you're allowed to use them, you can't.
[03:11.280 --> 03:13.320]  So, how's a PRL released?
[03:13.540 --> 03:16.620]  Well, when you buy a new phone, there's a PRL on it.
[03:17.260 --> 03:20.240]  You can get a PRL updated over the air.
[03:21.240 --> 03:27.280]  You can use a phone service tool, which is called a PST for short, and a data cable.
[03:27.720 --> 03:33.800]  And generally, you wouldn't do this, but you'd go into a wireless store and they'd do it for you.
[03:35.060 --> 03:40.860]  And, you know, that guy, this is Virgin Mobile's call center in Spokane, Washington.
[03:40.860 --> 03:43.680]  And he was pretty ticked off that we even went in there.
[03:43.820 --> 03:46.420]  And I think he might break your PRL if you tick him off.
[03:48.000 --> 03:52.800]  But, anyhow, wireless carriers, be it Verizon, Altel, U.S.
[03:52.840 --> 03:57.760]  Cellular, or Sprint, can and do change PRLs and your coverage over the air.
[03:57.900 --> 04:00.180]  And they don't give you any prior notice of this.
[04:00.280 --> 04:04.580]  They'll just flag your account, and the next time you call customer service, boom, you've got a new PRL.
[04:05.040 --> 04:08.120]  And it can make dramatic and sudden changes to your coverage.
[04:08.120 --> 04:12.760]  So this is, you know, really a big deal if you travel a lot and use your cellular phone.
[04:14.760 --> 04:15.660]  Oh, wait a minute.
[04:16.100 --> 04:18.740]  I want to... Sorry about that.
[04:19.500 --> 04:21.260]  That's the other thing I hate about PowerPoint.
[04:21.280 --> 04:24.480]  If you press the wrong button, it takes you to the wrong slide.
[04:26.100 --> 04:30.120]  So, how do you hack your PRL and really tick off your wireless carrier?
[04:30.180 --> 04:31.840]  That's probably what you want to know.
[04:32.040 --> 04:39.840]  The thing is, this isn't something, you know, to do at home, kids, unless you know exactly what you're doing.
[04:41.360 --> 04:44.200]  Because you will void the warranty on your handset.
[04:44.380 --> 04:51.100]  I absolutely guarantee and assure you that you will void the warranty on your handset if you attempt to do any of this stuff.
[04:51.280 --> 04:52.460]  So just know that up front.
[04:53.240 --> 04:56.600]  Also know up front that handset didn't really cost $19.95.
[04:56.600 --> 04:58.540]  It wasn't really free or whatever.
[04:58.980 --> 05:05.160]  If you break your handset messing around with this stuff, you're going to have to pay full retail for a new one, and that can be a few hundred dollars.
[05:05.160 --> 05:08.020]  So just know what you're getting yourself into first.
[05:08.800 --> 05:15.820]  If you make changes to your PRL, then you will violate the terms of service that your carrier has.
[05:15.900 --> 05:21.580]  And what that means is they can just cancel your service and sometimes even require you to pay the early termination fee.
[05:22.120 --> 05:23.580]  And there's nothing you can do.
[05:23.580 --> 05:37.820]  So if you change your PRL, which I do not recommend, it might be a good idea not to number it any differently than the carrier numbers their own PRLs.
[05:38.840 --> 05:42.740]  Because they can see what PRL revision you're running in your phone.
[05:42.880 --> 05:47.480]  And if it's something they've never released, it's probably not something that should be there.
[05:47.480 --> 05:50.560]  And some people claim this is illegal.
[05:50.900 --> 05:59.580]  Evidently, in Pennsylvania, it's illegal to even have any information on how to program a cellular phone if you're even a cellular store.
[05:59.900 --> 06:11.740]  Which doesn't make a whole lot of sense to me, but I guess it's only enforced if you're a hacker or the police think you might be some sort of person that looks shady.
[06:13.040 --> 06:17.660]  But I've never seen any specific laws against PRL hacking.
[06:18.040 --> 06:25.660]  I have this legal service plan at work and so I asked an attorney and she looked and she couldn't find anything.
[06:25.920 --> 06:29.800]  So to my knowledge, there are no specific laws against PRL hacking.
[06:30.560 --> 06:34.500]  Check with your attorney in your jurisdiction to find out for sure.
[06:36.340 --> 06:41.740]  So what you do to hack this thing is you download the PRL out of your phone first.
[06:42.580 --> 06:44.740]  And there's a tool called BitPim.
[06:44.860 --> 06:45.620]  It's open source.
[06:46.440 --> 06:48.780]  It's a little rough around the edges still.
[06:49.700 --> 06:56.720]  There's 0.62 as the last stable release, but it doesn't do a lot of things that you kind of actually need to do this stuff.
[06:56.720 --> 06:58.880]  So you're going to be running some pretty raw builds.
[06:59.520 --> 07:03.940]  I have the test 11 build on my machine currently.
[07:06.180 --> 07:20.200]  And what BitPim allows you to do, in addition to syncing your contracts and your address book and whatever other crap it's really designed to do, there's a tool in there to browse the file system on your handset.
[07:20.200 --> 07:21.680]  And that's really neat.
[07:21.860 --> 07:26.260]  There's a full-on file system in every CDMA handset.
[07:26.580 --> 07:31.860]  And you can get into it with BitPim and download any file and look at it in there.
[07:32.040 --> 07:36.900]  So that's another talk, but we're going to focus on the PRL that you can download out of there.
[07:37.980 --> 07:46.040]  Ordinarily, if you have a Verizon or an Altel handset, say, it will be in a directory called WACNVM, WACPRL.
[07:46.040 --> 07:55.080]  And the files are helpfully named PRL underscore quadruple zero and PRL underscore triple zero one.
[07:55.600 --> 08:07.680]  And those files represent the file that was originally on the phone and the last one that you downloaded.
[08:07.680 --> 08:17.500]  So if you reset your phone to its original factory settings, you know, if you look at your phone, there's probably a mode in there that allows you to reset it exactly the way it was at the factory.
[08:19.140 --> 08:23.180]  It'll restore your original PRL that your phone shipped with, and that's what that's for.
[08:23.600 --> 08:29.380]  Well, on Sanyo handsets that Sprint ships, those files are blank.
[08:29.460 --> 08:30.140]  They're decoys.
[08:30.580 --> 08:32.080]  They aren't actually used.
[08:32.080 --> 08:38.720]  Sprint buries it in the nvm subdirectory of the nvm directory, and that's hidden, actually.
[08:39.020 --> 08:42.760]  It was several revs of BitPim before they figured out how to display it.
[08:43.240 --> 08:48.840]  And then it's the nvm-0019 binary file.
[08:49.040 --> 08:59.860]  And so once you've got that downloaded, and I'll demonstrate how to do that in case you're a little stumped, you use a hex editor, and you have to truncate the first 86 bytes.
[09:00.460 --> 09:03.060]  And you want to get to a starting offset of 0f.
[09:03.920 --> 09:08.900]  I've got this in here just for reference because I'm going to post these slides for you to download later.
[09:09.320 --> 09:11.260]  But I'll demonstrate all this, of course.
[09:11.740 --> 09:15.820]  And you'll want to truncate all the nulls at the end, and there are a lot of them.
[09:16.380 --> 09:23.740]  And then you can now use your favorite PRL editor or disassembler to make the modifications that you'd like to make.
[09:26.120 --> 09:28.320]  So, what's inside these things?
[09:28.860 --> 09:34.540]  The top of the file, and I'll show you what one of these looks like, but you might want to jot these down.
[09:34.640 --> 09:36.660]  And I can come back to this, too.
[09:37.200 --> 09:39.120]  You've got an acquisition index.
[09:39.460 --> 09:51.460]  And the purpose of an acquisition index is to be able to locate, as quickly as possible, the channels and the frequencies that whatever carrier you're using are on.
[09:51.460 --> 09:55.400]  And so you'll have an entry for an acquisition.
[09:55.560 --> 09:59.760]  You'll have a corresponding acquisition index with the PRL entry.
[10:00.320 --> 10:09.300]  So, for readability and to endologically split up your PRL, they're separated into geographies.
[10:09.460 --> 10:14.180]  This is also so you can scan through in priority order by geography.
[10:14.180 --> 10:18.760]  And that's designed to, as quickly as possible, find an available carrier where you are.
[10:20.260 --> 10:29.900]  A lot of the way a PRL is structured has to do with performance and picking up the carrier that's available in your area just as quickly as you turn on your phone.
[10:30.900 --> 10:34.720]  You have home systems, and you can mark a system as home or as roaming.
[10:35.160 --> 10:40.480]  And on Sprint phones, this is a feature that Verizon phones do not generally have.
[10:40.600 --> 10:46.060]  But on Sprint phones, you've got an option where you can say, only use the Sprint PCS network.
[10:47.340 --> 10:53.520]  Well, that is used to only scan systems that have been marked in the PRL as home.
[10:53.520 --> 10:55.800]  And that way you never have to worry about roaming charges.
[10:56.860 --> 11:06.720]  And otherwise, if you set it to automatic mode, it will just pick up whichever carrier is available, always with a preference as described in the PRL.
[11:07.840 --> 11:10.460]  And you've got roaming systems, obviously.
[11:10.460 --> 11:11.920]  If it's not home, it's roaming.
[11:12.180 --> 11:16.280]  And that either costs you extra or doesn't, depending on your plan.
[11:16.740 --> 11:19.420]  And then there's negative roam systems.
[11:19.420 --> 11:30.020]  And this gets really interesting because a carrier can go in and they can say, you can't roam on this other carrier at all, even if you're calling 911.
[11:30.820 --> 11:35.760]  In Sprint PRLs, largely the systems that are marked negative are singular.
[11:36.060 --> 11:41.360]  And they do have one roaming agreement in one area with singular.
[11:41.520 --> 11:47.780]  And what it looks like is if you want to roam a roaming agreement with singular, they open up roaming to their whole darn system.
[11:47.780 --> 11:56.900]  And so the only way that you can prevent that if you're a carrier is to then mark the whole singular system except what you want to allow negative.
[11:58.120 --> 12:02.760]  Generally, carriers will allow roaming agreements by specific system ID.
[12:03.100 --> 12:11.560]  So, for instance, AT&T Wireless, which isn't present in the PRL, you can roam on in the Seattle area and Portland, anywhere in the Pacific Northwest, actually.
[12:11.560 --> 12:16.940]  But if you go to Los Angeles, California, you cannot roam on AT&T Wireless, even if you land there.
[12:18.520 --> 12:20.280]  So what can you change in these things?
[12:20.500 --> 12:24.400]  Well, unlike politics, essentially anything in a PRL you can change.
[12:24.560 --> 12:31.020]  But be careful because your carrier is going to catch on really quickly if your phone's doing something that it should never be able to do.
[12:31.120 --> 12:32.100]  And I'll give you an example.
[12:32.900 --> 12:36.300]  The guy who figured out how to do this stuff wasn't me.
[12:36.600 --> 12:39.520]  His handle is JamminMC and he's out of Denver.
[12:40.220 --> 12:47.520]  And he went into his PRL on his Sprint handset and hacked in a whole bunch of Quest system IDs.
[12:49.040 --> 12:53.020]  Quest is a local exchange carrier out on the west coast.
[12:54.800 --> 13:04.360]  And they run a wireless network that's been pretty much cut up and sold off half to Sprint and half to Verizon.
[13:04.360 --> 13:08.800]  But it's still operating in this kind of duct taping, chewing gum way.
[13:09.120 --> 13:16.280]  And as it happens, where JamminMC lives, he's got a Quest tower right near him.
[13:16.280 --> 13:19.520]  And the Sprint tower is really far away, so his Sprint service sucks.
[13:19.520 --> 13:22.580]  So he put in the Quest system ID for his area.
[13:22.800 --> 13:28.960]  And he was, for whatever reason, Sprint and Quest, even though they don't roam on each other at all, have a roaming agreement.
[13:31.060 --> 13:34.560]  Actually, Quest roams on Sprint, which is probably why it's reciprocal.
[13:34.920 --> 13:40.240]  But you would never roam on Quest if you have a Sprint handset.
[13:40.940 --> 13:43.260]  You'd never land on that by default.
[13:43.440 --> 13:46.660]  And so he was, you know, happily using Quest.
[13:46.660 --> 13:53.360]  And he not only did that, but he numbered his PRL something completely wacky that Sprint would never do.
[13:53.800 --> 13:56.320]  And they caught on in a real hurry.
[13:56.620 --> 13:58.160]  They knew exactly what he was doing.
[13:58.280 --> 14:03.600]  And I haven't heard whether he got a roaming bill or not, but he was threatened with a large one.
[14:03.600 --> 14:06.300]  So be careful, again.
[14:06.900 --> 14:10.860]  They're going to catch on if your phone's doing something totally wacky.
[14:10.960 --> 14:19.500]  You can tweak things that are plausible, but you can't tweak things that are implausible and get away with it.
[14:19.500 --> 14:22.640]  The most useful things to change are system IDs.
[14:22.900 --> 14:25.740]  And those are which carriers you're going to be using.
[14:26.060 --> 14:27.160]  Roaming priorities.
[14:27.580 --> 14:30.120]  So if Sprint or Verizon has a roaming...
[14:30.120 --> 14:36.060]  Say if Verizon in the Pacific Northwest has a roaming partner, U.S.
[14:36.120 --> 14:41.920]  Cellular, who has this really crappy network that they don't have very many towers.
[14:41.920 --> 14:45.140]  And you go analog a lot, and it just kind of sucks.
[14:45.340 --> 14:53.260]  And it's cheaper for Verizon to use them than it is to use Sprint, whose network's way better in eastern Washington, say.
[14:53.520 --> 14:57.340]  And you'd rather use Sprint's network in eastern Washington than U.S.
[14:57.360 --> 14:58.600]  Cellular because they suck.
[14:58.620 --> 15:02.020]  Well, maybe you could elevate Sprint in priority above U.S.
[15:02.040 --> 15:02.460]  Cellular.
[15:02.620 --> 15:05.700]  And, you know, because the roaming agreement's there, that might be plausible.
[15:08.400 --> 15:11.820]  But you...so that's where a priority could come in useful.
[15:11.980 --> 15:13.660]  You could improve your coverage, for instance.
[15:14.120 --> 15:16.080]  And digital versus analog preference.
[15:16.400 --> 15:30.420]  So Sprint, for example, until recently, would only allow you to roam analog, unless you were on another CDMA-1900 system.
[15:30.600 --> 15:32.620]  And so that's because it was cheaper.
[15:32.620 --> 15:36.840]  And they sold handsets that were compatible.
[15:36.840 --> 15:41.860]  They were tri-mode, that you could digitally roam on Verizon, you know, technically.
[15:42.180 --> 15:48.060]  And they had the roaming agreement in place, but they just didn't allow it and forced you to use battery-draining, crackly, crappy analog.
[15:49.720 --> 15:52.200]  So this is still the case in some areas.
[15:52.200 --> 15:59.200]  For instance, in the most recent PRL rev, Altel just got knocked to analog in a decent chunk of Michigan.
[15:59.940 --> 16:03.300]  It was digital before, so if you wanted to put it back, maybe you could.
[16:04.880 --> 16:09.440]  So once you've downloaded the thing and tweaked it, and, you know, I'm going to demo how you do that.
[16:09.640 --> 16:11.560]  How do you upload it back into your phone?
[16:11.680 --> 16:13.580]  Well, very carefully, please.
[16:13.980 --> 16:16.220]  You can fry your phone if you make a mistake.
[16:16.260 --> 16:29.720]  In particular, if you have a blank PRL and you upload it by mistake, then you're going to have an unusable, unbootable, completely toasted phone, and it's out of warranty because you messed with it, and they'll know you messed with it.
[16:30.380 --> 16:36.580]  So, basically, please be careful with this, and don't blame me if you fry your phone.
[16:37.680 --> 16:40.000]  And in general, you're going to need the phone service tool.
[16:40.000 --> 16:51.000]  Now, these are really interesting because they're made by the cell carriers, and, pardon me, they're made by the handset manufacturers, and they're provided to the cell carriers.
[16:51.260 --> 16:55.860]  And you and I can't just download them from the cell carriers page.
[16:56.020 --> 17:06.360]  They hide it behind some, you have to be, you know, a registered official ID, blah, blah, blah, SSL page that's all authenticated.
[17:06.360 --> 17:14.020]  And, you know, you have to, if you want to get access to it, you have to fill out some crazy form and tell them what wireless carrier you work for.
[17:14.200 --> 17:19.100]  And as far as I know, these things are free, but they just don't give them to normal people.
[17:19.100 --> 17:21.440]  They only give them to wireless carriers.
[17:21.660 --> 17:29.000]  But if you go out on these peer-to-peer networks, I don't know how this is, but it seems that they're out there.
[17:29.740 --> 17:34.620]  OverNet, for instance, also known as eDonkey, you can find a whole lot of CDMA tools.
[17:35.500 --> 17:38.460]  I haven't checked Causa or any of those.
[17:38.660 --> 17:46.640]  But if you want to get one of these, that may be your best alternative if you don't have a friend who works for a cellular store.
[17:49.320 --> 17:57.500]  And I'd like to acknowledge, you know, before I began, that this isn't stuff that I've done on my own completely.
[17:57.840 --> 18:01.220]  I've done some work in this area, and I'll show you the things that I've done.
[18:01.220 --> 18:07.980]  But XFF and CINEMA have a great site called WirelessWavelength.com.
[18:08.100 --> 18:14.440]  They've done very extensive data mining of FCC filings.
[18:14.680 --> 18:16.620]  There's a number of FCC databases.
[18:16.990 --> 18:25.940]  They've got crazy wireless spectrum maps, and they can tell you exactly who has what wireless spectrum and what part of the country.
[18:26.260 --> 18:32.820]  And they have been a tremendous resource to me in some of these activities.
[18:33.760 --> 18:38.780]  Jem and MC, bless his soul, he figured out how to create custom PRLs.
[18:38.920 --> 18:47.920]  And even though he did things not quite the right way on his own personal account, he did at least tell other people how to get started.
[18:48.780 --> 18:58.340]  And Justalurker, of Justalurker.com, developed a methodology for PRL interpretations.
[18:58.800 --> 19:02.040]  And so, he really is a data mining expert.
[19:02.240 --> 19:09.500]  And he went out and took a lot of this information that was in FCC databases and other sources, and he put it all together.
[19:09.500 --> 19:12.400]  And, you know, it's one thing to pull a PRL out of a phone.
[19:12.680 --> 19:24.520]  It's quite another to actually take it apart and know what it means and know which system IDs correspond with what carriers and be able to present that information in a human-readable and meaningful way.
[19:24.760 --> 19:27.020]  And Justalurker is the first guy who did it.
[19:28.980 --> 19:31.760]  Somebody I know does it now for Sprint.
[19:32.000 --> 19:33.540]  He's not here.
[19:34.980 --> 19:42.840]  But, yeah, that methodology is carried over to other carriers and other PRLs.
[19:43.380 --> 19:50.840]  So, you know, this is all work that the whole is greater than the sum of its parts for sure.
[19:51.320 --> 19:58.880]  So, without further ado, let's get to the demo, which is probably what you came for.
[20:01.400 --> 20:02.380]  Sure, Nakita.
[20:02.540 --> 20:02.780]  What's up?
[20:04.120 --> 20:07.260]  Can this be done on the chat phones?
[20:07.640 --> 20:22.540]  But, now that you've mailed a camp like a milker or a kind of Verizon or something like that, and, you know, if you stop using it, what's the condition you go to that radio chat and they will open up a special account and after they download the $30?
[20:24.540 --> 20:28.020]  It really depends on the handset, the carrier.
[20:28.360 --> 20:33.220]  There's any handset with a PRL in it, you can take the PRL out and play with it.
[20:33.400 --> 20:34.580]  Oh, I'll repeat the question.
[20:34.920 --> 20:53.620]  Nakita wanted to know, if you have a handset, an old handset that you've reactivated with a different carrier, can you edit the PRL, and any handset that uses CDMA technology and has a PRL in it, this methodology will work.
[20:53.800 --> 20:59.180]  But, to be clear, it may be slightly different depending on your handset.
[20:59.300 --> 21:04.420]  I'm, you know, specifically limiting the scope of this demo to my Sanyo 7200.
[21:04.420 --> 21:10.280]  The same thing works with Sanyo 4900s, Sanyo 8100s.
[21:11.560 --> 21:15.020]  The files may be in different locations on other phones.
[21:15.860 --> 21:23.460]  The hexadecimal offsets may be, they'll be the same, but how many bytes you need to truncate to get there might be slightly different.
[21:23.760 --> 21:28.260]  So, point being that, yes, you can do it.
[21:28.380 --> 21:32.720]  You might have to hack around a little bit in order to get things working the way that you'd want them to.
[21:32.720 --> 21:35.440]  And, of course, you'll need a data cable for that phone.
[21:35.640 --> 21:37.340]  So, that's another key.
[21:39.200 --> 21:41.640]  So, let's get BitPim popped open here.
[21:46.480 --> 21:47.060]  Yeah?
[21:51.860 --> 22:00.000]  Okay, so, to repeat the question, is the USB data cable or the serial data cable better?
[22:00.460 --> 22:02.700]  I use the USB data cable.
[22:02.860 --> 22:05.060]  I have not used the serial data cable.
[22:05.060 --> 22:11.720]  I don't see any reason why the serial data cable wouldn't work, but the USB cable does, and that's what I use.
[22:16.130 --> 22:17.310]  So, inside BitPim...
[22:18.030 --> 22:19.590]  You know, it does...
[22:19.590 --> 22:27.010]  I'm not going to go to the phone book, because that will actually display all of the numbers of my friends, and I don't want you all to have them.
[22:27.010 --> 22:30.190]  But, yeah, sorry.
[22:30.790 --> 22:41.450]  But, you can sync your phone book, and your wallpaper, and ringtones, and calendar, and all that bling crap that I don't care in the least about.
[22:42.710 --> 22:44.170]  Except one thing.
[22:44.470 --> 22:46.010]  Yeah, I'll demo that.
[22:47.330 --> 22:47.890]  Yeah.
[22:51.490 --> 22:53.230]  Oh, you'll hear in just a moment.
[22:54.370 --> 22:56.630]  Presuming my singular phone actually works.
[23:13.600 --> 23:19.400]  Yeah, that's the one piece of bling that I care about on my phone, and only this crowd would actually know what that is.
[23:19.920 --> 23:22.700]  But, yeah.
[23:23.040 --> 23:25.680]  So, the file system's the interesting part.
[23:25.880 --> 23:29.640]  And so, we'll browse the file system here, and you can see kind of what's in it.
[23:36.380 --> 23:37.580]  And BitPim's free.
[23:37.760 --> 23:38.460]  It's open source.
[23:38.740 --> 23:41.040]  It's one of those fun things.
[23:46.010 --> 23:46.490]  Okay.
[23:46.830 --> 23:49.010]  And so, my demo's not blowing up yet.
[23:49.010 --> 23:49.850]  That's amazing.
[23:51.150 --> 23:53.670]  So, you've got a lot of fun stuff in here.
[23:53.670 --> 23:56.890]  And what we care about is the NVM directory.
[23:57.350 --> 24:00.350]  And NVM means non-volatile memory, I think.
[24:02.350 --> 24:03.870]  And in here...
[24:03.870 --> 24:04.550]  Oh, look.
[24:04.610 --> 24:05.610]  They're trying to fake you out.
[24:05.690 --> 24:06.970]  You've got this PRL directory.
[24:07.230 --> 24:12.290]  So, on a Verizon handset, your PRLs will always be here, and these actually will be the PRLs.
[24:12.570 --> 24:16.050]  So, you'll download these, and you'll be set.
[24:16.190 --> 24:17.210]  But not Sprint.
[24:17.350 --> 24:17.450]  No.
[24:17.530 --> 24:19.110]  They're a little more clever than that.
[24:19.250 --> 24:21.870]  They've got this hidden NVM directory that...
[24:22.590 --> 24:25.590]  You've got to read the file system a special way to even see it.
[24:26.070 --> 24:30.370]  And once you're in here, there's all this, you know, intuitively named stuff.
[24:31.430 --> 24:31.870]  And...
[24:32.450 --> 24:39.770]  So, what I had to do was actually just, you know, go through all of these and hack through them until I figured out which one was the PRL.
[24:39.770 --> 24:43.550]  But in this case, it's NVM 0019.
[24:43.870 --> 24:45.690]  And that's what this is.
[24:45.850 --> 24:46.670]  So, we're going to save it.
[24:47.990 --> 24:49.670]  And we'll save it to...
[24:49.670 --> 24:50.130]  Sure.
[24:51.470 --> 24:53.090]  We'll save it to...
[24:53.810 --> 24:55.330]  Save it to the demo directory.
[25:02.580 --> 25:07.800]  So, now that I've got this here, I can close out BitPen.
[25:12.720 --> 25:16.180]  And I want to pop open a hex editor.
[25:16.740 --> 25:18.220]  And I use XVI32.
[25:18.900 --> 25:20.920]  You can use any hex editor you like.
[25:20.920 --> 25:25.700]  This one's free and it's easy to use.
[25:26.500 --> 25:30.220]  And so, when we go into the demo directory...
[25:37.720 --> 25:38.280]  What?
[25:38.440 --> 25:39.660]  Why is my file not here?
[25:42.200 --> 25:43.180]  Oh, yeah.
[25:43.340 --> 25:43.620]  That's right.
[25:43.760 --> 25:44.000]  I'm sorry.
[25:46.340 --> 25:46.880]  Thanks.
[25:48.080 --> 25:48.500]  Okay.
[25:48.840 --> 25:50.740]  So, then we get to truncate bytes.
[25:51.340 --> 25:54.520]  And, yeah, we've got to truncate 86 of them.
[25:55.500 --> 25:56.040]  So...
[26:13.330 --> 26:13.870]  Okay.
[26:14.110 --> 26:18.730]  And so, I can't really delete that fast and count.
[26:19.010 --> 26:22.870]  But, you know, I knew it was somewhere in the 80s.
[26:22.870 --> 26:26.570]  And what you do is you're looking for the first offset here of 0F.
[26:26.730 --> 26:28.750]  And that's the correct offset.
[26:29.550 --> 26:33.150]  And so, then if we scroll down to the end...
[26:36.990 --> 26:38.610]  You see all these nulls.
[26:38.890 --> 26:40.650]  And there's like a mile of them.
[26:41.710 --> 26:43.390]  And they all have to go.
[26:50.300 --> 26:51.340]  So, yeah.
[26:51.760 --> 26:55.580]  I get to sit here and hold down the delete key for a long time.
[26:59.460 --> 27:03.540]  Because if you don't hold down the null...
[27:03.540 --> 27:11.360]  If you don't get rid of the nulls, then what happens is your PRL editor won't actually open the file.
[27:11.620 --> 27:13.120]  It thinks that it isn't a PRL.
[27:13.120 --> 27:16.800]  The BitPim dumps the file out in this kind of...
[27:17.520 --> 27:19.240]  It reads it out of memory.
[27:19.240 --> 27:21.780]  And it just reads the memory locations.
[27:21.880 --> 27:24.160]  And it reads everything that's in them.
[27:24.360 --> 27:27.120]  And so, the PRL actually isn't...
[27:28.340 --> 27:33.080]  You know, that's a subset of the memory address range that it dumps.
[27:33.320 --> 27:37.200]  Since it's just taking a memory address range in your phone and dumping it to a file.
[27:37.200 --> 27:42.960]  And so, that ends up, you know, having a lot of weird crap at the beginning that you don't need.
[27:42.960 --> 27:44.360]  That you have to get rid of.
[27:44.540 --> 27:47.580]  And that's pertinent to the phone, but just not the PRL itself.
[27:47.880 --> 27:50.360]  And then you've got all these nulls at the end that you have to get rid of.
[27:51.260 --> 27:52.720]  But we're almost done.
[27:53.440 --> 27:54.260]  Whoa, shit.
[27:57.160 --> 27:57.560]  Yeah.
[27:57.900 --> 27:58.300]  Oops.
[27:59.000 --> 28:02.360]  Yeah, so that's something that sucks because...
[28:02.920 --> 28:03.900]  Well, look at that.
[28:04.120 --> 28:04.460]  I...
[28:04.940 --> 28:10.300]  So, I did this a few times when I was starting to do this and said, Oh, goddammit.
[28:10.500 --> 28:13.100]  And went through and did this again, like, many times.
[28:13.180 --> 28:20.340]  And I'm not going to do that now because I have a handy-dandy copy of a file that I've already done this with.
[28:20.980 --> 28:21.420]  So...
[28:21.420 --> 28:26.100]  I mean, if you want, I'll do it again just to prove I'm not lying to you and it really does work.
[28:26.240 --> 28:26.920]  I don't know.
[28:26.920 --> 28:28.040]  Well, I guess I've got time.
[28:28.260 --> 28:29.240]  It's up to you guys.
[28:29.420 --> 28:31.020]  How much Q&A time do you want?
[28:31.740 --> 28:32.480]  We're fine.
[28:32.540 --> 28:32.980]  Okay.
[28:33.180 --> 28:33.520]  We're fine.
[28:33.640 --> 28:33.920]  Okay.
[28:34.120 --> 28:37.440]  In that case, let's go to our PRL editor.
[28:37.820 --> 28:38.260]  And...
[28:38.880 --> 28:39.280]  Oh, yeah.
[28:39.380 --> 28:43.900]  That's something that I don't have in my, like, happy, fun directory.
[28:48.510 --> 28:49.710]  Oh, I don't like that one.
[28:53.500 --> 28:54.720]  I don't like that one either.
[28:58.150 --> 29:00.610]  Well, let's use the Kyocera phone service tool.
[29:00.770 --> 29:01.390]  That works.
[29:03.430 --> 29:04.450]  Is that installed?
[29:04.610 --> 29:04.990]  Yeah, I do.
[29:05.330 --> 29:05.630]  Good.
[29:06.370 --> 29:13.130]  I don't like this one as much as the Nokia one, but we've got a PRL editor here.
[29:14.190 --> 29:14.790]  Okay.
[29:15.030 --> 29:16.610]  I own a Kyocera phone.
[29:17.290 --> 29:20.510]  This was available for download on a public website.
[29:20.510 --> 29:24.110]  I do not think this is a copyright violation at all.
[29:24.110 --> 29:36.750]  If it is, you know, Kyocera, any Kyocera reps here, is there anyone from Kyocera here who can tell me whether I'm violating the copyright or wants to tell me to cease and desist?
[29:37.310 --> 29:37.870]  No?
[29:38.110 --> 29:38.370]  Okay.
[29:38.370 --> 29:38.410]  Okay.
[29:40.690 --> 29:41.350]  All right.
[29:41.630 --> 29:42.990]  So, I assume we're fine then.
[29:43.230 --> 29:45.610]  We're going to take a look at 10024.
[29:47.210 --> 29:50.410]  That is the current PRL for Sprint.
[29:51.330 --> 29:53.230]  And it's PRL.
[29:54.310 --> 30:02.890]  And, oh, well, this, you know, it's got a view here where you can actually go in and look in this, you know, grid format.
[30:03.530 --> 30:11.930]  Or, if you want, you can dump it to a text file, which is normally what I do, because that you can easily import into Excel.
[30:12.170 --> 30:19.450]  And I've got some fun Excel macros where I can look at what changed between PRLs, which is really what people care about.
[30:20.990 --> 30:24.130]  What changed between the last PRL and the new one?
[30:24.330 --> 30:25.390]  What's the new stuff?
[30:25.590 --> 30:26.970]  Which systems got taken away?
[30:27.110 --> 30:28.170]  Which new ones got added?
[30:28.970 --> 30:30.970]  What did Sprint do with digital roaming?
[30:30.970 --> 30:32.810]  That's usually the biggest concern.
[30:33.010 --> 30:36.250]  It's, did they take away our digital roaming again?
[30:36.690 --> 30:36.910]  Ah!
[30:38.110 --> 30:40.070]  Since sometimes there's...
[30:40.070 --> 30:42.290]  Or, did they take away U.S.
[30:42.370 --> 30:44.950]  Cellular roaming in the case of Verizon around a year ago?
[30:45.050 --> 30:48.610]  They had this weird on-again, off-again relationship with U.S.
[30:48.670 --> 30:49.050]  Cellular.
[30:49.470 --> 30:50.430]  And U.S.
[30:50.490 --> 30:56.070]  Cellular is just a huge carrier in the Pacific Northwest geographically, east of the Cascade Range.
[30:56.230 --> 31:00.450]  They cover pretty much everything except for one little chunk that Inland Cellular owns.
[31:00.450 --> 31:03.810]  And so they, Verizon has a roaming agreement with Sprint.
[31:04.130 --> 31:06.890]  And they had this, have this roaming agreement with U.S.
[31:06.930 --> 31:07.310]  Cellular.
[31:07.430 --> 31:09.030]  But whether you could roam on U.S.
[31:09.090 --> 31:12.250]  Cellular for free was just this odd variable.
[31:12.490 --> 31:13.970]  And it would fluctuate wildly.
[31:14.170 --> 31:16.930]  Like one PRL you could and the other PRL you couldn't.
[31:17.190 --> 31:19.910]  And of course the PRL doesn't control what you get billed.
[31:19.990 --> 31:21.450]  It's all, it's all in the billing system.
[31:21.450 --> 31:24.810]  But you have to assume that you're going to have billed based on what the PRL says.
[31:25.210 --> 31:29.910]  So it's, you know, it's always an odd, you know, an odd variable.
[31:30.130 --> 31:33.950]  So normally what people care about here is, is what's in the PRL.
[31:33.950 --> 31:37.890]  Well, as you can see, you've got a, hold it.
[31:38.050 --> 31:42.950]  Let me copy this to a text file so I can crank the font size up some.
[31:44.070 --> 31:45.870]  Because it's a little hard to read here.
[31:48.290 --> 31:51.210]  Oh no, that doesn't work in the Kyocera PST.
[31:51.490 --> 31:54.970]  Like you actually have to select the thing and scroll to the bottom and copy it.
[32:00.480 --> 32:03.760]  Uh, no, no, the PRL editor is generic actually.
[32:04.000 --> 32:06.540]  I don't like Kyocera's as much as Nokia's.
[32:06.720 --> 32:12.300]  But, um, yeah, we can scan in on this a little better with Word, I think.
[32:12.620 --> 32:14.560]  Uh, we'll do it at page width.
[32:15.920 --> 32:17.000]  Is that more visible?
[32:17.920 --> 32:18.940]  Okay, good.
[32:19.600 --> 32:20.480]  Oh, accept it.
[32:21.620 --> 32:22.740]  Yeah, oh well.
[32:23.800 --> 32:25.840]  I guess I could careerize it.
[32:25.840 --> 32:26.140]  Um,
[32:32.200 --> 32:32.680]  there we go.
[32:33.120 --> 32:33.500]  Fuck.
[32:33.800 --> 32:35.200]  Yeah, now we're not weird anymore.
[32:36.100 --> 32:36.780]  Okay, good.
[32:37.020 --> 32:38.920]  So, uh, you've got an acquisition table.
[32:39.200 --> 32:43.220]  And what the acquisition table is, is effectively an index number.
[32:43.400 --> 32:44.940]  And yeah, the text is a little off.
[32:45.060 --> 32:47.340]  But that's the price we pay for being able to read this.
[32:47.560 --> 32:50.520]  And I'm just gonna scroll through it because I'll show you how it works.
[32:50.900 --> 32:56.160]  Um, for entry zero, the system ID is 4106.
[32:56.760 --> 32:58.260]  Uh, yeah, this isn't gonna work.
[32:58.360 --> 32:59.400]  We're gonna need to look over here.
[32:59.400 --> 33:02.960]  Like, because it's, uh, where it munched the formatting.
[33:03.900 --> 33:07.520]  Um, the system ID is 4106.
[33:07.800 --> 33:08.560]  Uh, the NID...
[33:08.940 --> 33:11.060]  Well, let's see if I can get to it over here.
[33:11.180 --> 33:11.300]  Yeah.
[33:11.500 --> 33:13.100]  Is this more visible on this side?
[33:14.020 --> 33:14.460]  Okay.
[33:15.020 --> 33:17.440]  The NID is nearly always 65535.
[33:17.740 --> 33:18.800]  You don't need to worry about that.
[33:18.800 --> 33:23.980]  Um, the negative and preferred column is, is this a preferred roaming partner?
[33:23.980 --> 33:26.240]  Or is this somebody that you can't roam on at all?
[33:26.560 --> 33:29.920]  In Sprint's case, is it singular or isn't it?
[33:30.760 --> 33:33.960]  Um, generally singular is the non-preferred.
[33:33.960 --> 33:44.300]  Um, the geography, um, that defines the, uh, you, you split up the geography because you've got numerous geographies in your PRL.
[33:44.560 --> 33:50.540]  And then you scan through the geographies for each, um, priority order.
[33:50.540 --> 33:56.760]  And then, so you go geography, you scan across geographies and across priorities.
[33:57.120 --> 34:01.880]  So, um, in the last geography at the lowest priority, that's the last one the phone gets to.
[34:02.080 --> 34:07.980]  And the goal there is to try to find the quickest, find you service as quickly as possible.
[34:08.520 --> 34:16.180]  Um, priority is, uh, designates, is it the same geography or is it a new geography?
[34:16.180 --> 34:22.120]  And, uh, which is prioritized more above the other, um, depending on the context.
[34:22.940 --> 34:29.900]  Um, so, uh, we've got an acquisition for index number 39.
[34:29.900 --> 34:31.960]  Our acquisition index is 37.
[34:32.800 --> 34:38.820]  And so for 37, that generally mean, that, that means digital A and B.
[34:38.940 --> 34:42.920]  But if you scan across here, you can see what that means.
[34:42.920 --> 34:46.700]  Generic Cellular Channel 1 is both A and B.
[34:47.740 --> 34:52.380]  And, uh, 4, acquisition index 4 is amps.
[34:54.120 --> 34:56.340]  So you've got digital and analog cellular.
[34:56.600 --> 34:58.300]  Uh, you know, this is a good example here.
[34:58.500 --> 35:03.440]  And nearly, in nearly all cases, for cellular carriers, you're going to have an entry that looks like this.
[35:03.540 --> 35:04.180]  You'll have a SID.
[35:04.820 --> 35:09.260]  Um, you'll have an acquisition index of 37, which is for digital CDMA.
[35:09.260 --> 35:14.000]  You'll have a secondary, second acquisition index of 4, which is for analog CDMA.
[35:14.460 --> 35:16.240]  Uh, that one is a little weird.
[35:16.380 --> 35:24.860]  Because if digital will, the acquisition index 37 will start out with digital and then fail over to analog if it's not available.
[35:25.080 --> 35:25.740]  So it's redundant.
[35:25.740 --> 35:30.460]  And it took me a long time to figure out why in the world Sprint was duplicating this.
[35:30.460 --> 35:36.240]  And as it turns out, you can specify analog only.
[35:36.620 --> 35:45.880]  And so if you specify analog only, what it'll do is it'll go to this acquisition index 4 rather than acquisition index 37 for the roaming partner in the area.
[35:46.160 --> 35:54.320]  Um, unless you take all of the acquisition index 4s out, and then it'll go to 37, fail over to analog, but it takes longer to pick up a carrier.
[35:54.320 --> 35:56.480]  So that's why Sprint does that.
[35:56.780 --> 35:59.240]  Um, and the roam indicator is zero.
[35:59.480 --> 36:02.800]  And that means that on my phone, it will say that it's roaming.
[36:03.080 --> 36:06.220]  Uh, versus one which is not roaming.
[36:06.420 --> 36:09.580]  And actually that's the, that's used for one other purpose.
[36:10.140 --> 36:15.840]  Sprint's firmware will scan only Sprint systems if you set your phone to only use Sprint.
[36:16.000 --> 36:20.640]  And then, then it will only pick up these carriers with the roam indicator of one.
[36:20.640 --> 36:26.900]  So if you've got different acquisition indexes than 37 and 4, usually that means it's PCS bands.
[36:27.220 --> 36:29.640]  And those are in the 1900 megahertz range.
[36:30.080 --> 36:33.480]  So this is what a PRL looks like, but it's pretty raw.
[36:33.700 --> 36:35.640]  I mean, what the hell is SID 1506?
[36:36.280 --> 36:37.220]  That doesn't mean a lot.
[36:37.720 --> 36:44.660]  Um, so that's where we get to the interpretations I've done.
[36:57.320 --> 37:02.140]  And just a lurker uses the same format because I stole his.
[37:02.780 --> 37:04.980]  Um, it was a good format.
[37:05.240 --> 37:07.880]  Uh, I have made a lot of changes to his data.
[37:08.200 --> 37:11.500]  He also had an automated means of generating this stuff.
[37:11.500 --> 37:19.840]  And I'm both too lazy and too stupid to get this into a database where I can automatically export this as XML or something.
[37:20.120 --> 37:28.820]  And, uh, have a fun set of transforms that makes pages automatically and gets this thing out in like five minutes after a new PRL hits.
[37:29.300 --> 37:34.840]  But someday, people smarter than me will help me do this and, um, it'll be a lot faster.
[37:34.840 --> 37:38.340]  For now, it's a lot of manual cut and paste and research and so forth.
[37:38.540 --> 37:44.600]  The changes I've made are, um, there were a lot of errors in the underlying data that he was using.
[37:44.920 --> 37:55.340]  And people who don't work for cellular carriers, um, have been kind enough to help correct some of this data.
[37:55.660 --> 38:01.660]  And give me really accurate data that looks remarkably like it came out of carrier databases or something.
[38:01.660 --> 38:06.180]  But, you know, who am I to complain because, uh, I don't know what the source is.
[38:06.980 --> 38:10.620]  Um, so, this is a little more readable.
[38:11.020 --> 38:13.720]  Uh, this is what the current PRL looks like.
[38:13.840 --> 38:18.120]  And as you can see, when you turn on your phone, the first thing that it looks for is Sprint in Boston.
[38:18.720 --> 38:20.620]  For whatever reason, arbitrarily.
[38:21.360 --> 38:23.840]  And then it looks for Sprint in New York, Philadelphia.
[38:24.440 --> 38:31.380]  Then, if it can't find that, um, and remember it'll search across all of the geographies in Pry-1 before it gets to Pry-2.
[38:31.380 --> 38:34.820]  But we'll scroll down within the Northeast Geography and see what it uses.
[38:35.400 --> 38:39.660]  Um, and it'll use, it'll use, uh, so what does this mean?
[38:39.940 --> 38:41.500]  Uh, what does one of these entries mean?
[38:41.760 --> 38:43.220]  Well, can you guys read this?
[38:43.560 --> 38:44.760]  Is it too small?
[38:46.420 --> 38:48.360]  Let's see if I can crank up the text size.
[38:49.640 --> 38:50.580]  Is that a little better?
[38:50.580 --> 38:51.280]  No.
[38:52.540 --> 38:52.940]  Okay.
[38:53.180 --> 38:53.280]  Good.
[38:57.540 --> 38:59.000]  So, well, that's the best I can do.
[38:59.160 --> 39:03.780]  I've got IE set to largest and I could try to use accessibility or something.
[39:03.960 --> 39:05.920]  But no, that's, uh, it's not worth the time.
[39:06.600 --> 39:12.580]  Um, so, priority one, you know, this, the first entry is the system ID 4106.
[39:12.580 --> 39:17.300]  Uh, PCS indicates that it's scanning the PCS bands.
[39:17.800 --> 39:24.280]  Uh, the double green dash means that that's a, an area that you're not roaming in.
[39:24.880 --> 39:30.560]  Uh, you know, obviously, Sprint PCS Boston just means this, this is where this system ID lives.
[39:30.560 --> 39:34.560]  Um, and then scan 500B, 600B, blah, blah, blah.
[39:34.620 --> 39:43.300]  That is a breakout of the acquisition index, um, that in the PRL corresponds with the system ID.
[39:44.080 --> 39:48.820]  And, uh, so for Pry-2, you can see, you know, they use U.S.
[39:48.900 --> 39:49.740]  Cellular a lot.
[39:50.140 --> 39:53.920]  No surprise, their analog roaming is cheap and really crappy.
[39:54.520 --> 39:57.380]  Um, and, uh, more U.S.
[39:57.460 --> 39:57.900]  Cellular.
[39:57.900 --> 40:02.940]  Then you get to Verizon, uh, and, uh, A is analog.
[40:03.640 --> 40:06.100]  Uh, D-A is digital analog, obviously.
[40:06.320 --> 40:07.460]  RM means you're roaming.
[40:08.180 --> 40:12.440]  Uh, these, 224A for Bangor, Maine, for instance, and all the way down.
[40:12.660 --> 40:19.320]  What those are is, that's the, uh, cellular market area as defined by the FCC.
[40:19.640 --> 40:21.600]  They're all numbered in an FCC database.
[40:22.120 --> 40:25.780]  And A means that it's scanning on the A-side cellular license.
[40:26.220 --> 40:29.140]  So, uh, I don't know what all of these are.
[40:29.480 --> 40:31.720]  You know, 1620 is an example.
[40:32.340 --> 40:38.220]  That's something where I don't know which cellular market area Honesdale, Pennsylvania, um, corresponds to.
[40:38.340 --> 40:39.360]  Actually, that's been fixed.
[40:39.480 --> 40:40.720]  XFF sent me the data.
[40:40.960 --> 40:44.500]  But, so it's out on the live site, but it's, uh, it's not here on my copy.
[40:45.060 --> 40:52.180]  Um, so anyhow, if you want to walk through this on your own, I'll give you the URL at the end.
[40:52.180 --> 40:58.660]  And you can go out to the site and download your very own copy of this and, and the presentation, which I'll have up there by end of day.
[40:59.300 --> 41:01.940]  Um, but this is the end product.
[41:02.360 --> 41:12.000]  Uh, if you want to see a demo of actually editing a PRL, um, would you guys like to see how a PRL could be edited?
[41:12.620 --> 41:13.060]  No.
[41:13.080 --> 41:13.480]  Okay.
[41:13.960 --> 41:18.880]  Um, so we'll go back into the Kyocera PST.
[41:19.300 --> 41:25.540]  I'm not going to put this one on my phone though, because I don't know who all's here or whether this is illegal.
[41:25.780 --> 41:30.740]  So, um, you know, I'm not going to commit potentially a federal crime in front of hundreds of people.
[41:31.140 --> 41:36.340]  Um, but I'll show you how you could edit a PRL, you know, what you might change.
[41:36.340 --> 41:41.620]  And then, uh, uh, wait a minute, I started the wrong one.
[41:42.060 --> 41:43.920]  Yeah, Kyocera PST is weird.
[41:44.040 --> 41:52.160]  It runs this server and then you have all these weird client utilities that connect to the server and then your phone.
[41:52.560 --> 41:54.980]  Um, so we'll go back into the editor.
[41:58.880 --> 42:00.740]  Okay, so we have a PRL.
[42:02.820 --> 42:03.220]  And...
[42:11.490 --> 42:14.850]  System ID 6 is Verizon Wireless.
[42:18.030 --> 42:18.430]  In...
[42:23.780 --> 42:25.640]  Uh, in Washington State.
[42:27.660 --> 42:29.620]  Oh, did I not open this in edit mode?
[42:34.220 --> 42:35.980]  Yeah, I did not open this in edit mode.
[42:36.040 --> 42:40.860]  You know what I'm going to do is I'm going to open this in the Nokia one, because that's, that one, that's the one I normally use.
[42:56.620 --> 42:57.420]  Here we go.
[42:58.100 --> 42:58.840]  Much better.
[43:02.410 --> 43:10.630]  So, this one's a little less friendly, but, um, I like this because I can go to record number.
[43:12.810 --> 43:13.790]  That's what I'll do.
[43:16.760 --> 43:18.780]  You'll see where I'm going with this in a second.
[43:34.290 --> 43:35.170]  Ah, shoot.
[43:42.200 --> 43:43.040]  Okay, good.
[43:43.040 --> 43:44.940]  So, we'll go to 107.
[43:46.240 --> 43:49.500]  Okay, so what I was looking for was which record is there.
[43:49.760 --> 43:54.420]  And, uh, this is the acquisition table, so if you wanted to add new acquisition tables, you could.
[43:55.060 --> 43:56.980]  Um, but we'll go to 107.
[43:57.740 --> 44:02.600]  And let's say that I want to create a new entry for AT&T Wireless.
[44:03.500 --> 44:04.260]  Um,
[44:08.040 --> 44:14.120]  we will add the SID, 00047.
[44:15.880 --> 44:18.000]  And it's a preferred system.
[44:19.700 --> 44:25.100]  And it's, the geography is the same as the previous region.
[44:25.100 --> 44:27.820]  And the priority is higher than the next.
[44:28.880 --> 44:32.700]  And the acquisition index is 4, because this is analog.
[44:35.000 --> 44:36.160]  And bingo.
[44:43.140 --> 44:46.120]  Now I have a PRL that I could load into my phone.
[44:46.640 --> 44:51.760]  And AT&T Wireless is now preferred over Verizon Wireless in the Pacific Northwest.
[44:51.760 --> 44:55.820]  Um, Sprint has a roaming agreement with AT&T Wireless there.
[44:56.240 --> 45:04.000]  Um, and I entered the system ID for Washington State, Western Washington in particular, AT&T Wireless.
[45:04.400 --> 45:18.600]  And so if I flipped my phone over to roaming with that file in it, and I was in Seattle, instead of picking up John, James Earl Jones, or whoever the heck it is, uh, saying Darth Vader Verizon Wireless, I'd, uh, I'd actually get AT&T Wireless.
[45:19.140 --> 45:21.640]  Um, and be able to use their better analog coverage.
[45:21.960 --> 45:24.940]  Um, Verizon's analog coverage is horrible in the Northwest.
[45:25.460 --> 45:26.780]  It's, it's the worst I've ever seen.
[45:27.220 --> 45:30.320]  So I've got around three minutes for questions, I guess.
[45:30.640 --> 45:32.620]  Um, if anyone has questions.
[45:33.980 --> 45:35.200]  Yeah, you have a question.
[45:35.200 --> 45:38.740]  Um, would this work for a prepaid speaking
[45:44.740 --> 45:46.920]  service, and then update it?
[45:47.300 --> 45:53.760]  Assuming the phone company could find it quickly, would they be able to do anything other than shut your service off for that prepaid phone?
[45:53.920 --> 45:59.620]  That's a terrific question, because Virgin Mobile is a prepaid service that uses Sprint's network.
[46:00.200 --> 46:08.620]  Um, remember, it doesn't matter what's in your PRL if there's not an arrangement on the backend for you to actually be able to use that service.
[46:08.620 --> 46:24.800]  So, if you went in and you removed the negative roaming entries for Singular, for instance, um, you know, we don't have Singular analog in the Northwest, so I've never tested this, but my guess is that you would actually be able to roam on Singular in places you never should be able to if you did that.
[46:25.200 --> 46:29.240]  Um, if you have Sprint non-prepaid service, uh, postpaid.
[46:29.680 --> 46:32.700]  Virgin Mobile, on the other hand, you can only use Sprint's network.
[46:32.860 --> 46:34.960]  They don't have any roaming agreements with anybody.
[46:34.960 --> 46:36.760]  It's all blocked in the billing system.
[46:37.100 --> 46:43.300]  So, um, aside from the fact that their firmware is locked, but, you know, I'll tell you this much.
[46:43.320 --> 46:44.480]  I've gotten around that.
[46:44.620 --> 46:50.240]  I've gotten a PRL in there, um, that, you know, would be roaming strictly to see whether or not I could do it.
[46:50.320 --> 46:55.960]  And it's, uh, it doesn't work because there's just no roaming on the backend set up.
[46:57.860 --> 46:58.760]  Any other questions?
[46:58.760 --> 47:00.020]  Yeah, I have a question.
[47:00.380 --> 47:07.720]  Um, I had a friend who had a problem, had a legitimate problem with his PRL on his phone, got, I guess, corrupted during the over-the-air download.
[47:08.880 --> 47:19.020]  And the, the tier three tech support person told me that it's the subscriber's responsibility to manually download a PRL monthly on Verizon.
[47:19.260 --> 47:20.920]  Have you heard anything about this before?
[47:21.960 --> 47:26.520]  Verizon's infamous for, you know, they have such nice customer service people.
[47:26.520 --> 47:30.660]  Well, they're, they're, a lot of them are in Bellevue, Washington, right down the street from where I live, actually.
[47:30.840 --> 47:32.660]  And, uh, they're, you know, they're so nice.
[47:34.060 --> 47:38.840]  And they just make up the most interesting things to tell their customers.
[47:38.940 --> 47:41.480]  I've just heard the most bizarre things ever.
[47:41.900 --> 47:49.840]  Um, they want you to update your PRL all the time, of course, because, uh, they're, they're changing it around in order to save them money on roaming agreements.
[47:49.980 --> 47:56.680]  And, of course, they want you to hit star 228 and, like, completely wreck your coverage in given areas, because it costs them less.
[47:56.940 --> 48:00.860]  But, no, it's not your responsibility to download monthly.
[48:01.060 --> 48:10.640]  It's, uh, it's, it's your responsibility to do that if you want a PRL that, you know, you look at each PRL and you see, well, what are the advantages and disadvantages of upgrading?
[48:11.220 --> 48:18.340]  And you wait for somebody like me, or just a lurker, or any of the, say, Bill Radio, or any of the guys who, uh, who do this.
[48:18.540 --> 48:24.180]  And you see whether, uh, whether a PRL update is something that makes sense, given where you live and where you travel.
[48:25.120 --> 48:37.500]  What, um, as far as phones that are easiest to utilize this technique on, what, what ones are most, uh, has most of the work been done on?
[48:37.820 --> 48:44.300]  And, uh, as a follow-up to that, is there been any work done on the PC cards for, uh, data services?
[48:44.300 --> 48:50.260]  Uh, the Orinoco PC cards can only be used on that carrier system, actually.
[48:50.560 --> 48:57.600]  Uh, they have, uh, a special PRL in them, um, as I understand it, that only works with that given carrier.
[48:57.780 --> 48:58.620]  And it, it makes sense.
[48:58.740 --> 49:03.920]  There's no, unlike on the GSM side, there's generally no data roaming agreements on CDMA.
[49:04.120 --> 49:05.020]  It's for voice only.
[49:05.860 --> 49:07.640]  Um, what's easiest?
[49:08.060 --> 49:09.460]  Oh, none of them are easy.
[49:09.460 --> 49:15.660]  I have Kyocera and, uh, Sanyo handsets, and I've had good success in each.
[49:16.120 --> 49:21.740]  Um, yeah, it looks like I'm gonna be thrown off the stage if I don't get off, so I can't answer...
[49:21.740 --> 49:28.520]  Yeah, uh, so I, well, I'm finished with the question, but I would like to tell you the, uh, site where these things can be found.
[49:29.020 --> 49:31.600]  Um, and that is here.
[49:43.010 --> 49:43.490]  Yep.
[49:43.490 --> 49:44.570]  Now let's do that.
[49:45.150 --> 49:45.930]  There we are.
[49:47.110 --> 49:53.210]  Uh, could you tell me quick, how do you find out which system IDs correspond to what, uh, carrier and what location?
[49:54.270 --> 50:03.510]  Um, I can't tell you that really quick, but my email address is tprofit at tprofit.org, and you are welcome to correspond with me privately.
[50:03.510 --> 50:06.390]  I'll be more than pleased to tell you, uh, how to do this.
[50:06.390 --> 50:12.410]  Or you can look at justalurker.com, and he has a great walkthrough of how he does it for Verizon.
[50:12.810 --> 50:17.250]  And, you know, that's a great place to start, actually, because then you can ask me specific questions.
[50:20.170 --> 50:20.790]  Thanks, guys.