Cingular Treo 650 Unlock Hack

Following yesterday’s release of the new ROM updates for the Sprint and Unlocked Treo 650, a clever cookie apparently figured out how to use these to convert the ROM of a locked Cingular Treo 650 GSM to that of an Unlocked Treo 650 GSM (which has DUN enabled and thanks to the new update also better memory management among others).

I was originally pointed to a post at UneasySilence which offered detailed but somewhat confusing and complex steps to follow for the unlocking procedure.  However, leaving aside the fact that I couldn’t quite understand the process, I also lacked a Cingular Treo 650 to potentially try it on and so when A. Davis (who is quite a bit more of a techhead than I am) told me via email that he was going to give it a go I asked him to share his story with us if he was successful at unlocking it:

Well, thank goodness it worked.   My charger was at home, so I had to wait to do the update after I got home this evening.  As it turns out, I've been sync'ing via bluetooth for so long that I didn't realize my sync cable was bad, so I was forced to wait for it to work over IR, which was painfully slow... but in the end it worked (more on this later).  I followed the instructions from UneasySilence (read these first). Here's a simple run down:

0) A pre-requisite that UneasySilence’s instructions left out: The Unlocked GSM update page at PalmOne mentions upgrading a few applications like DocsToGo and Zap2016 (the only two listed that applied to me) before proceeding with the actual ROM upgrade. On my Treo 650, I upgraded both of these to the latest version.

1) I started with an AT&T (Cingular, but without the Cingular logo on the case) GSM Treo 650 with the 1.0.4.1 firmware. I sync'd over bluetooth and backed up my system. I have a few extra SD cards, so I took one and blanked it out.

2) I downloaded the 1.23 firmware upgrade referenced in the instructions.  I unzipped it and had a new "PALM" folder.  I copied the folder straight to the SD card.  I then set my email clients (GoodLink and Snapper) to not auto-retrieve, turned off my radio, removed my SIM card, and removed my primary SD card, then did a soft reset.

3) The phone booted up and I popped in the SD card with the copied 1.23 update and followed the prompts.  At one point, you have to click OK and it appears to do nothing, but just click it once and if you wait 10 to 30 seconds, it proceeds.  I saw the progress bar, some scrolling text, then it reset itself prompted for my language, reset again, prompted to setup the digitizer, reset again, etc.

4) After all was done I popped in my SIM card and checked the phone version... it was at 1.23. Perfect so far...

5) Next I downloaded the 1.13 Software Updater (for firmware 1.28) for unlocked GSM phones from the Palm website and unzipped it.

6) Next I went into Palm Desktop and created a new user called UPGRADE.

7) First, I removed the SD card containing the 1.23 upgrade and my SIM card, then from my PC ran the executable that does the update (please follow the instructions that palmOne provided for the Unlocked GSM update).  At this point, I found out that my USB sync cable is bad.  I'd been sync'ing over BT for so long, but after loading 1.23, I couldn't get a bluetooth connection working properly.  Thus, with no BT and no USB cable, IR was my only choice (thank goodness I had choices).  I setup hotsync on both ends to use IR and let it run.  For me, this process took close to an hour.  I'm sure it would have been much faster via the cable (more like 20 or 30 minutes).

8) The upgrade instructions tell you to sync and go through the reset hoops, then return to the installer and click next to go to step 2 of 2.  I did this and it prompted to restore my data.  At first, I was a little panicked as it said it was ready to "restore data for user UPGRADE", but I clicked next anyway and was presented with the choice to create a new user or use an existing one.  I chose my normal sync ID and let it run.

It restored all my data, again over IR, in about 30 minutes.  When all was done I was quite disappointed to learn that I had only gained about 1 or 2Mb of extra space (went from 6.1Mb to 7.8Mb free).  But then I went into SnapperMail, copied all my mail to the SD card, deleted all of my mail from the phone, then restored it back from the SD card. Afterwards, I had 17.2Mb free... quite an improvement.

The last thing I did was to go back to Palm Desktop and delete the UPGRADE user, then perform a final hotsync. I popped in my SIM card and regular SD card, did a soft reset, then went over to PowerRun and told it to re-create all my shortcuts. One thing I found was that I had to re-run Dataviz-tech (which I normally leave in phone memory) and told it again move everything to the card.  It prompted about progs already on the card and asked if I wanted to overwrite. I  chose yes and all is working just fine.

I now have Firmware 01.28 and Software: Treo650-1.13-ROW. Also, in my Bluetooth settings, I now have a "Dial-Up Networking" option.

Odds are pretty good that PalmOne will make an update to disable this "update hack" and protect precious Cingular/AT&T from unscrupulous individuals like myself.  As such, I'm putting both the 1.23 zip file and 1.28 zip files on my website for future generations to abuse, errr... I mean enjoy

EDITOR’S NOTE: Please CAREFULLY read ALL instructions posted BOTH here, UneasySilence and palmOne support before proceeding with this unlock hack as we really don’t want anything bad to happen to your beloved Treo…

Finally, if all that you’re interested in doing is to enable DUN on your Cingular Treo 650 then the most straightforward option remains PDANet ($34).  However, you won’t benefit from the improved memory management that optimizes memory handling and frees up more memory.

How-to: Upgrade Locked Cingular GSM Treo to an Unlocked GSM version [UneasySilence]
Finally… Treo 650 Sprint and Unlocked ROM Updates [Treonauts]

UPDATE REGARDING CARRIER UNLOCK: I initially thought that this unlock hack would also unlock the Cingular GSM Treo 650 for use with any other carrier’s SIM card but unfortunately A. Davis reports that:

“I just tried SIMs from Verizon (they now have a worldphone that operates in both CDMA and GSM via a Vodaphone partnership) and from a T-Mobile phone. Both came up with the standard "You can't use this SIM in this phone" message and allowed only for 911/SOS calls.  So, it is confirmed, the unlock hack only unlocks features and removes branding, but doesn't unlock the carrier aspect of the phone. On the plus side, however, I now have BT DUN and I can get future updates whenever PalmOne releases them which is more often than not a lot more frequently than the carriers themselves do.”

[Many thanks to A. Davis for his clear and very useful instructions and also to ‘signedandsealed’ for pointing me to the UneasySilence post.]

Treonauts don’t like to be locked…