Getting the Lock Code on an LG Mobile Phone

A few weeks ago, my trusty LG Env3 met its untimely demise in a washing machine. I immediately yanked the battery out first. None of the usual tricks worked. I tried many of them, but here are a few that HAVE worked for me in the past with other peoples' phones:

  • Take it apart and blow-dry the electronics
  • Seal it in a container of uncooked rice or other desiccant overnight

This isn't about drying a phone out, though. I surfed eBay and was taken aback by the prices for used but working Env3's. So I decided to buy a broken one. Preferably one with a mechanical problem where the non-damaged mechanical parts from my electronically-fried phone could be put to good repair use. Like this one:

Lo and behold, the case was pretty well damaged and the ribbon cables joining the two halves had been severed. Otherwise, the phone seemed to be in okay shape. Commence repair. We are Env3 of Borg. Parts everywhere, mix and match a frankenphone. What a mess!

There's not much I can teach you about this. If you have the know-how to disassemble the pieces of two nearly-identical non-working objects and you know which parts are bad, you can probably assemble one good working unit. That's not what this is about, either.

This is about what happened to me once I powered on the resulting piecemeal ware -- something that happens probably more often than you'd think, whenever you buy a used phone from someone you don't know: The Lock Code... OF DOOM.

By default, the lock code is the last-four digits of the phone's programmed phone number during initial programming. This is different than the SERVICE CODE which is usually six zeroes. In the case of the eBay phone, though, we don't know the phone number. The easiest way to find out is to access the service menu. On newer LG phones, you enter "##PROGRAM" followed by the VX- model number, and hit send. The model number can usually be found inside the phone behind the battery compartment.

If it's a QWERTY clamshell like mine, the phone must be opened and the code must be entered on the QWERTY keyboard. Example: The Env3 is a VX-9200 and the service menu is accessed by hammering in [Sym]3[Sym]3PROGRAM9200[SEND] which shows on the screen as "##77647269200"

A prompt will show up for the service code. Again, this is 000000 by default.

Access the "Service Programming" menu, usually the first option. And don't change anything.

You'll see the Mobile Equipment ID and ESN on the first screen...

...and the Phone Number on the second screen. Write the phone number down. Exit the service programming menu. This will usually cause the phone to turn off or reboot.

Try the last four digits of the phone number as the unlock code. Usually, this works. When you call your provider to activate your phone, this unlock code should be changed to the last four digits of your phone number, and you're in the clear. Consult your user manual if you wish to de-activate locking.

In my case, however, the user was savvy or paranoid enough to know that friends who know the mobile number could probably guess the lock code. That is to say, the lock code on this phone was NOT the last four digits, and I was still locked out of the phone I paid for. At this point, I'm thinking that it'd have been nice for the seller to remember there was a lock code and to provide it. Oh well. Who am I to let a little 4-digit code get in my way? Not bloody likely.

Most phone service techs will charge $30 to $50 to remove the lock code. Highway robbery is somewhat expected with these guys, though. Enter my good old friend: QPST. Officially for service technician use only, QPST is a suite of programs for troubleshooting and programming phones using Qualcomm's lineup of mobile baseband processors. I used QPST in an article just over 2 years ago when discussing tethering.

The same thing applies. You can't buy QPST, but it's "out there" and you can easily download it or get it from a friend who works in the industry. You also have to run it on Windows, or at least in a virtual machine. If you do try to get it "in the wild" you should probably have a good anti-virus solution installed. You'll also need a data cable for your phone. LG's newer phones ship with a data cable and a USB Wall-Wart, so you probably already have a data cable.

Once you have the phone hooked up and the drivers installed, you should be able to see the phone in the QPST Configuration tool. If not, click "Add Port" and add one of the USB Serial ports. Select the phone from the list and launch the "Service Programming" tool from the "Start Clients" menu.

Flip over to the "1X/HDR Security" Tab and click the "Read From Phone" button. Voila. You've found the lock code! Below, you can see it was set to 4776. You should also be able to change it from this menu, but I didn't bother trying.

While there are some pretty cool things you can do with QPST aside from the things I have covered on HiR, you can also brick or damage your phone when you mess with it at this level, so think before you act.

blog comments powered by Disqus