Bruce Graham wrote:That Simple.
Yeah, that simple. Of course the work munk did to scour the firmware code and hack a solution wasn't so simple.
The hacked control.asc firmware you'll be FTP'ing is essentially the same as the original with one important exception. The instructions that normally tell the Brain Board to go out and look at U16 for an ESN are instead now telling the Brain Board to return a specific hard-coded ESN (the one in munk's text file), so no matter what your Brain Board's real ESN, the hacked firmware will always return this specific ESN (because the firmware is now instructed to do that). And since we know what the unlock codes are for OS 5.1 and a number of plugs for this specific ESN, this software can be authorized and operated just as though the ESN coming back was from the U12 chip on the Brain Board.
The reason munk said he could make this hack ESN any ESN you want is that for him, now that he's done all the heavy lifting, it's a simple matter of substituting a different ESN in the control.asc firmware. This might be useful in a scenario where we find a donor who is willing to share a 5.1 ESN that has a larger number of plugins authorized and has the unlock codes for all of those.
Pretty cool.