Unlocking a Telus Samsung Galaxy Apollo

Nov 2012

Let's get the rant out of the way: Cell phone subsidy locks are an evil abomination. This is because they are abused; I understand how they came to exist but any cell provider is evil if it charges anything, or has any conditions, for unlocking a phone post-contract or a phone purchased outright. Specifically, the evil is in creating a revenue stream out of the removal of subsidy locks after the subsidy has been paid off or if there never was a subsidy; this is why legislation is needed to make this practice illegal. Unlocking should be free after the contract ends or if the phone is purchased outright.

I don't know if this is common to all Android phones but on my Galaxy Apollo the dialer code *#7465625# lists the locks and shows their enabled/disabled status. The phone was purchased from Telus and had two locks enabled: The Network Lock and the SP Lock. The SP (Service Provider) Lock makes the phone insist on a Telus SIM card while the Network Lock ties the phone to Telus' network. I expect all Telus phones are like this. Both locks need to be disabled to free the phone.

So, all ranting aside, you're reading this probably because you have a Telus locked Samsung Galaxy Apollo and you want to unlock it. You know what provider you want to bring the phone to and you know that the phone will work on its network. You have two options.

Method 1: Pay for an unlock code

This is the option for you unless you embrace technology and are comfortable hacking on internal phone configurations that could brick the phone. I used this method because I only knew half of Method #2.

If you're paying for an unlock code then be very careful that you're actually unlocking all of the subsidy locks. In my case, when I inserted a Koodo SIM into the phone it prompted me for the "Network Lock Control Key". This process was successful but it only removed the SP Lock — presumably the Network Lock was left in place because Telus and Koodo are on the same network (they're the same company). I needed to insert a SIM from a provider which does NOT use Telus' network; when I did — and power-cycled the phone again — I was prompted a second time for the Network Lock Control Key and the same code unlocked the Network Lock.

I can't resist a mini-rant! Imagine if I were a non-technical user who did not know about using the above dialer code to show the status of the subsidy locks. After removing the first lock I could have blissfully gone travelling, purchased a local SIM card expecting it to work, and become crushed when the second unlock prompt unexpectedly appeared, with me believing that I had already unlocked the phone! One shouldn't be expected to know that there are multiple locks involved and how to trigger each of their unlock conditions! Subsidy locks are just plain evil!

Method 2: Edit two bytes in a binary file

Are you comfortable messing around with data files that consumers aren't meant to see? Files that are hidden in unfamiliar places? Have you already rooted your phone? Do you know how to use adb? You need to have said "yes" to all of those before you even begin to consider this method.

Here's the secret: The Network Lock is stored in byte 0x40a05 of the phone's /esp/nv_data.bin file, and the SP Lock is in byte 0x40a07. After I had unlocked both locks with the code those locations had changed from 0xda to 0xdb and 0xbb to 0xbc, respectively, among other locations which I know not the relevance of. Note that unlocking the SP Lock changed three bits — that surprised me.

I tested this by restoring the nv_data.bin file which I had backed up before the unlocking, noted that the phone was again locked, made those two edits, and tested that the phone was unlocked and worked with a non-Telus SIM. It did.

Needless to say, if you decide that you want to try this approach and you need to ask for help then you don't have the skills to do this. I won't help, so don't try to ask me. See this site's disclaimer.

Credit where credit is due: The 0x40a05 edit is well-known and I found it via a web search.