N95 Smallest Free SP Unlocking Device First In The World

Use this only in education purposes, and this shows how 1024 RSA key, AES, etc on N95 can be avoid using ONLY 32 CPLD logic cells!

You need:

1. Xilinx CPLD xc2c32a-6-qfg32
2. push button
3. some copper wire, etc

You have to program CPLD with file "n95unlocker.jed" (Right click and select "Save target as").
Details about xc2c32a can be found on www.xilinx.com on document "ds310.pdf" (Right click and select "Save target as").
On same site can be found FREE tools for programing, also look for FREE simple JTAG interface for Xilinx devices.

Solder:

- pins 11,21,26 to GND
- pins 4,12,20,27 to VCC +1.8v (more than 2v will destroy chip!!!)
(Don't forget to solder small smd 100nF on GND and VCC!)
- pin 6 = clk (test point)
- pin 7 = ad0 (test point)
- pin 8 = push button (and second end of push button to GND)
- pin 14 = jtag TDI
- pin 15 = jtag TMS
- pin 16 = jtag TCK
- pin 25 = jtag TDO

Jtag wires is used only once to program xc2c32a and can be removed after
programing.

Unlocking procedure:
===============

1. First, be sure that version of N95 is: V 06wk41v23.4 17-04-07 RM-159 (c) Nokia

2. Next, you can make backup of field 308,1

3. Disassemble N95 and solder 4 wires: ad0, clk, vcc, gnd
In case you are not sure how to disassemble your N95, you can click here.

4. Use some isolating tape on edge of N95 board and assemble N95.

5. Power phone WITHOUT SIM card inside!!!

6. Once phone enter OFFLINE mode, enter: #pw+aaaaaaaaaaaaaaa+b
(aaaaaaaaaaaaaaaa = can be any 15 digits number, b = appropriate provider unlock key Nr from 1 to 7 !!!)
In case that you are having problem entering the letters "P", "W" or "+", please click here on How To Enter Unlock Code.

7. Now press push button and fast enter on phone #

8. If everything is ok, PHONE WILL BE UNLOCKED! and you can remove 4 wires.

B.R.
Dejan