This guide exploits the flaw found in the UVLE1 Radio T-Mobile binary that allows users to disable network lock through a hidden menu.
Warning: Following these instructions will in most cases void your warranty. There is also a chance of damaging your phone or "bricking" it. I take no responsibility for anything that happens from following these instructions. Follow the instructions at your own risk. Follow your local laws.
Disclosure: Due to me messing with my Galaxy S II, it's currently unable to shut down properly. The screen turns off but the button lights stay on. I have to hold down the power button to reset it. This is an example of one of the many things that can go wrong.
a. Preparation:
- Download Odin and ClockworkMod Recovery. I personally used Odin found here (ignore the other files) and ClockworkMod found here, but you should be able to just use the one included in the first zip. Extract the Odin exe and ini. Leave the recovery as a tar file.
- Download your stock radio binary from here. You can see which radio your phone natively uses by going to Settings->About Phone->Baseband version. For my Koodo phone, it was the TLLG2.
- Download the flawed UVLE1 radio binary. If it is unavailable from the previous site, you can find it here or from a quick google search.
- Using a usb connection, transfer the 2 radio binary zips to your phone.
b. Install and Run ClockworkMod Recovery Using Odin (original source, summary with adjustments below):
- Run the Odin exe and connect your phone, if Odin successfully detects your phone, there should be a yellow box that says COM something. If not, dial *#7284#, which will open a hidden menu. Don't touch UART, set USB to the other setting and back, this should cause the drivers to be reinstalled on your computer.
- Set your phone to recovery mode by holding down volume down and the power button. When the phone vibrates, release the power button, but hold the volume button until the recovery screen shows up. Some people reported that they needed to hold both the volume up and down buttons. When the screen shows up, press volume up.
- In Odin, click the PDA button and select the recovery tar file. Once this is successful, your phone should boot up.
- Reset your phone again like in step 2, but this time hold both volume up and down. This should bring you to a blue ClockworkMod Recovery menu.
- (HIGHLY RECOMMENDED) At this point, before you proceed, you should use CWM's backup and restore option and create a backup. Reboot the phone and copy the backup (clockworkmod folder) to your computer. Then return to the ClockworkMod Recovery menu by repeating step 4.
- Select "Install zip from sdcard" and navigate to the sgh-t989_uvle1_radio.zip. After successful install, select the reboot phone option.
c. Use the Hidden Menu to Disable Network Lock (orignal source, summary below):
With SIM from another provider inserted
Dial *#197328640#
Press [1] DEBUG SCREEN
Press [8] PHONE CONTROL
Press [5] SIMULATION
Press [6] NETWORK LOCK
Press [3] PERSO SHA256 OFF
Wait 30 seconds
Press Home, Back
Press [4] NW LOCK NV DATA INITIALLIZ
Wait 60 seconds
(It's questionable if the waiting does anything)
d. Restore to Stock Radio Binary
- Open the ClockworkMod Recovery again using step b.4.
- Select "Install zip from sdcard" and navigate to the stock radio zip (eg SGH-T989D_TLLG2_Koodo_radio.zip). After successful install, select the reboot phone option.
Your phone is now unlocked!
Sources:
http://galaxys2root.com/t-mobile-galaxy-s2/how-to-root-icsgb-on-t-mobile-galaxy-s2-sgh-t989/
http://forum.xda-developers.com/showthread.php?t=2024514
http://forum.xda-developers.com/showthread.php?t=1895400
http://xenomorph.net/android/sgh-t989/