RIM has the keygen published on their website but you need a password to get to it (Perhaps it is for partners only?) You can see the site here: https://www.blackberry.com/EngineeringScreens/

Earlier this year a few websites published their own keygen to compute the unlock code. Much to my dismay, however, none of them decided to share exactly how they did this. With that, I decided to discover the unlock code myself and publish the results.

The unlock code is actually a simple HMAC digest with a SHA1 variant. The trick is knowing what data to throw at the algorithm to produce the proper unlock code. The data used includes:

1. The BlackBerry device PIN
2. The application version (including parentheses if provided)
3. The current uptime of the device in seconds
4. The unlock duration
5. The secret sauce

The relevant data needed was found by inspecting “net.rim.device.internal.EScreens.EngScreenSecurity”, however, I will not go into the details of that here. Once I found the unlock duration codes and the secret key, it was just a matter of putting them into a standard HMAC hash function and out came the unlock code.

In order to use an unlock code, you simply visit the “Help Me!” screen by pressing alt+shift+H on your BlackBerry device to get the necessary information, generate a code, and then type it directly into the Help Me screen. No characters will be echoed, but if you enter it correctly, the screen with change over to the “Engineering Screen” main page. Do note it is possible to make some changes in the “eScreen” that could cause your phone to operate improperly or even break completely so do proceed with changing values at your own risk.

Now I wont point fingers at the various people that have already discovered how this is done but refused to share the code or details with anyone. They are what prompted me to undertake this project in the first place. With that, I give you the Python source code to my basic unlock code keygen:

#!/usr/bin/env python
 
import hmac
import hashlib
 
pin = 'ffaa0000'            # Device PIN                [XXXXXXXX]
app = '4.6.0.100 (233)'     # OS Application version    [n.n.n.n (n)]
uptime = '12345'            # Uptime in seconds             
duration = 30               # Duration for key to last  [1, 3, 6, 15, or 30]
 
lifetime = {
 1: "",
 3: "Hello my baby, hello my honey, hello my rag time gal",
 7: "He was a boy, and she was a girl, can I make it any more obvious?",
 15: "So am I, still waiting, for this world to stop hating?",
 30: "I love myself today, not like yesterday. I'm cool, I'm calm, I'm gonna be okay"
}
 
secret = 'Up the time stream without a TARDIS'
 
data = pin + app + uptime + lifetime[duration]
hash = hmac.new(secret, data, digestmod = hashlib.sha1)
key = hash.hexdigest()[:8]
 
print key

Weighing in at only 25 lines, this shows how simple the algorithm actually is if one only knows how to put it together. If you want a packaged online tool, then by all means check out the other published keygens, but if you are curious how the codes actually are generated (like I was) feel free to take, use, and share this code at your will.

However, our task was to be able to make outbound calls without the need to use the web interface to place the call. What essentially had to happen is when you dialed a number on your SIP phone, Asterisk would have to talk to the Google Voice site and handle the call setup for you.

***UPDATE***: I worked with Ward Mundy of Nerd Vittles who put togeather a complete solution for both Asterisk 1.4 and 1.6. Additionally we are now using pyGoogleVoice which is a more complete library than Paul’s script below. For the full write up, check out: http://nerdvittles.com/?p=635

Paul then created a Python AGI (Asterisk Gateway Interface) script. It integrates into your dial plan and allows for the call to be made. The logic flow is as follows:

1. You pick up your SIP phone and make a call.
2. Asterisk receives your call and the google-voice-dialout.agi script is called.
3. The script contacts Google Voice and initiates a call based on the number passed to asterisk.
4. Google Voice then dials your Gizmo5 number which rings into Asterisk.
5. Asterisk identifies this call by its caller id and the script binds your outbound call and the incoming call from Google
6. Google proceeds to call out to your destination.
7. Call is connected!

Now a few caveats to this approach. As Paul’s script is essentially screen scraping using unpublished API’s to the Google Voice application, any changes made to their web API could break this script. (As he notes in the script comments) At any rate, at the time of writing it works and the script is available for download here, google-voice-dialout.agi, or shown below for reference.

When I get some more time, I will post details how to integrate this into an Asterisk dialplan and other features.

#!/usr/bin/env python
 
# google-voice-dialout.agi
# Paul Marks (http://pmarks.net)
#
# This is an Asterisk 1.6 script to place outgoing calls through Google Voice.
# It will automatically sign into the web interface, and submit a click2call
# request through your registered Gizmo number.  Asterisk can then answer
# the incoming call, and Bridge() it into your original outgoing call.
#
# I deduced the click2call sequence by using the "Live HTTP Headers" Firefox
# plugin.  If the website changes too much, this script will probably stop
# working, so don't use it for anything too important.
#
# This assumes you've already configured Asterisk to receive Gizmo calls.
#
#
# This rule will redirect outbound calls to this script:
#   exten => _1NXXNXXXXXX,1,AGI(google-voice-dialout.agi)
#
# This rule will connect the inbound GV/Gizmo calls:
#   exten => s/6502650000,1,Bridge(${DB_DELETE(gv_dialout/channel)}, p)
#              ^-- Put your 10-digit Google Voice number here.
#
#
# To test this script from the command line without Asterisk, type the
# following.  Be sure to type a few linefeeds at the end:
#
#   $ ./google-voice-dialout.agi
#   agi_channel:
#   agi_dnid: 18004664411
#
 
# Put your Google login and Gizmo number here:
USERNAME = "username@gmail.com"
PASSWORD = "password"
GIZMO_NUMBER = "17475555555"
 
import httplib
import urllib
import re
import sys
import time
 
class Error(Exception):
    pass
 
def ReadAgiEnvironment():
    env = {}
    while 1:
        line = sys.stdin.readline().strip()
        if not line:
            break
        key, data = line.split(':')
        env[key.strip()] = data.strip()
    return env
 
def SendAgi(cmd):
    sys.stdout.write("%s\n" % cmd)
    sys.stdout.flush()
    sys.stdin.readline()
 
class SimpleCookieJar(object):
    cookie_re = re.compile(r"(?i)set-cookie: (\w+)=([^;]+).*")
    def __init__(self):
        self.cookies = {}
    def addCookies(self, response):
        for header in response.msg.headers:
            m = self.cookie_re.match(header)
            if not m:
                continue
            self.cookies[m.group(1)] = m.group(2)
    def get(self):
        return "; ".join("%s=%s" % kv for kv in self.cookies.iteritems())
 
class GVClickToCall(object):
    USER_AGENT = "google-voice-dialout.agi/1.1"
 
    def __init__(self, username, password, via, dial):
        self.username = username
        self.password = password
        self.via = via
        self.dial = dial
        self.cj = SimpleCookieJar()
        self.h = httplib.HTTPSConnection("www.google.com")
        self.login()
        self.placeCall()
        self.logout()
 
    def login(self):
        print >>sys.stderr, "Logging in."
        postdata = urllib.urlencode({ "Email": self.username,
                                      "Passwd": self.password })
        self.doRequest(
            method="POST", url="/accounts/ServiceLoginAuth",
            body=postdata,
            headers={ "Content-Type": "application/x-www-form-urlencoded" })
 
        # Start at https://www.google.com/voice, and collect cookies as we
        # follow all the redirects.
        PREFIX = "https://www.google.com/"
        location = "/voice"
        for i in xrange(5):
            response, html = self.doRequest(
                method="GET", url=location,
                headers={})
 
            location = response.getheader("location")
            if not location:
                # No more redirects, yay!
                break
 
            # All redirects should fall within the same domain.
            if not location.startswith(PREFIX):
                raise Error("Unexpected redirect: %s" % location)
            location = location[len(PREFIX)-1:]
 
        # Scrape magic _rnr_se value from the HTML.
        m = re.search(r'name="_rnr_se" type="hidden" value="([^"]+)"', html)
        if not m:
            raise Error("Can't find _rnr_se.  Not logged in?")
        self.magic_rnr_se = m.group(1)
 
    def placeCall(self):
        print >>sys.stderr, "Calling %s via %s" % (self.dial, self.via)
        postdata = urllib.urlencode({ "outgoingNumber": self.dial,
                                      "forwardingNumber": self.via,
                                      "_rnr_se": self.magic_rnr_se })
        response, http = self.doRequest(
            method="POST", url="/voice/call/connect",
            body=postdata,
            headers={ "Content-Type": "application/x-www-form-urlencoded" })
        print >>sys.stderr, "Dial response:", http
 
    def logout(self):
        self.doRequest(
            method="GET", url="/accounts/Logout",
            headers={ "Connection": "close" })
        print >>sys.stderr, "Logged out."
 
    def doRequest(self, headers, **kw):
        headers["User-agent"] = self.USER_AGENT
        headers["Cookie"] = self.cj.get()
        self.h.request(headers=headers, **kw)
        response = self.h.getresponse()
        self.cj.addCookies(response)
        return response, response.read()
 
def main():
    env = ReadAgiEnvironment()
    print >>sys.stderr, env
 
    agi_channel = env["agi_channel"]
    agi_dnid = env["agi_dnid"]
 
    # Write the channel ID to Asterisk's database, so it can be accessed
    # by the incoming call when it arrives.
    SendAgi("database put gv_dialout channel %s" % agi_channel)
 
    SendAgi("answer")
    try:
        GVClickToCall(username=USERNAME, password=PASSWORD,
                      dial=agi_dnid, via=GIZMO_NUMBER)
 
        # Asterisk should patch in the incoming call while we're asleep.
        time.sleep(10)
    finally:
        SendAgi("hangup")
 
if __name__ == '__main__':
    main()

DISCLAIMER: Stripping DRM from eBooks treads heavily on the DMCA. Any instructions here should be considered to be for educational purposes only. Therefore you are responsible for how you use this information.

Here were the steps I followed to free my books from my iPod:

Step 1

First you need an iPod or iPhone. I find it is easiest and most cross-platform to use a jailbroken device as that makes this process all the easier.

Step 2

Install the Kindle app from the App Store

Step 3

When you open the app for the first time, you will be prompted for your Amazon.com username and password. Once you enter this your device will be registered and you can purchase books from the Amazon Kindle Book Store.

Step 4

UPDATE: Amazon has taken the “security by obscurity” route and removed the UUID from the website. You can still find it easily by connecting your iPod/iPhone to iTunes and when you see the Serial Number, click on the word “Serial Number” and it will change to “Identifier” this is the string you are looking for. Here is a picture for clarity.

Step 5

Purchase your favorite book from the Store ;-) Your purchase will be automatically downloaded by the app once you are connected to the internet.

Step 6

This is the tricky part. Now that you have the books purchased and on your iPod/iPhone you will need to get them off. There are two routes here. A few folks over at MobileRead.com mentioned that you can use the iPhone Backup Extractor, however, at this time it is only for Mac OS X.

UPDATE: fugislider informed me there is also a iPhone Backup Extractor version for Windows and Linux you can use as well if you don’t want to jailbreak your device.

The better solution in my opinion is to use a jailbroken phone and copy the books direct from the device using SCP or similar mechanism. I wont go into the details of how to jailbreak or SCP files as that is covered by several other articles…

The eBooks are stored as .prc files which are DRM’d MobiPocket format. (Same as the Kindle, no surprises there) You can find all of them in this folder on the iPod / iPhone:

1

/var/mobile/Applications/{Appplication UUID}/Documents/eBooks

There are also some .mbp files in the directory, which seem to be unneeded for extracting the books. Also note they have some crazy names that don’t appear to correlate to their actual title, so you will have to rely on software such as Calibre to read the headers and tell you what files you have.

Step 7

Well, there is no longer a Step 7. Sorry.

On March 11, I received notice from Amazon.com to remove the instructions relating to removal of the DRM from the books. I left the first 6 steps intact since they do not relate to breaking any portion of the DRM and are in full compliance with the DMCA. If you want to remove the DRM from these books you will have to find instructions elsewhere.

The End!

We just release PyAMF 0.4-RC2 yesterday! While it is not quite the final version, this is a huge step for the project and includes a ton of updates and features.

Some highlighted features include:

• cPyAMF – An implementation of PyAMF serialization that results in tremendous speedups.
• SQLAlchemy Adapter – Adapter for the popular Python Database ORM.
• Improved Google AppEngine Adapter – makes deploying Flex/Flash apps on Google’s new service even easier.

You can see our official announcement on the PyAMF Blog.

Currently PyAMF 0.4 is in the Release Candidate stage so we are testing and getting feedback. The release candidate and final version (when it is ready) are available for download here.

Last night, Google launched App Engine which allows developers to create web applications and publish them on Google’s infrastructure. The exciting part of the App Engine in my eyes is that the language you use to develop on it is Python. Google provides many API’s to interface the Python programming language with the various services they offer. You can authenticate via Google accounts, use Bigtable to store data, and use Google Aps to bind your application to your own domain. They opened the initial “Preview Release” to the first 10,000 developers to sign up. From the looks of it, those 10,000 spots filled up within the first few hours of the launch.

I was fortunate to be one of the first to sign up and got my account last night. I created a basic hello world application to test and overall the system seems very easy to use. My demo is at http://labs.appspot.com.

I also created an account for the PyAMF project and we were able to get a PyAMF echo server running on App Engine. It is currently located at: http://ae.pyamf.org We are continuing to work with it today and tomorrow to write up some examples and a How-to to get people started quickly. We will continue to add more examples to the site as time progresses and we get everything documented.

The most noticeable addition to Hydra recently has been the addition of the Flex UI. Flex is an open source Flash framework from Adobe that allows for rapid development of Rich Internet Applications (RIAs). Behind the Flex UI is the powerful Twisted framework that powers the data back end. Communication between Flex and Twisted is handled by the PyAMF library. PyAMF is an implementation of Adobe’s Action Message Format (AMF) for Python. This library allows for data to be exchanged in a binary form which is many times faster than the traditional XML mechanism.

Enough talk, lets get to the show! Here is a shot of the CPE LiveGrid module from Hydra. LiveGrid handles adding, searching, modifying, and deleting of CPE’s and assets withing the system. This module was originally based on an XML API, however, after changing to PyAMF speeds over doubled when running:

The second example here is of the CPE LiveDiag module. This allows for real time graphing and analysis of a CPE’s performance in the network and will allow network administrators to make faster diagnostics when problems occur. This module was also a port from its original XML interface to the PyAMF library:

These are just a few of the new interfaces coming in the release of Hydra EMS.

Back in January I discovered the PyAMF project. This project’s goal is to create an implementation of AMF (Action Message Format) for the Python Programming language. Last week they released version 0.1.0, their first stable release.

So far, I have been extremely impressed with this project. The library offers integration with popular Python web frameworks including Twisted, Django, and Pylons. The performance is excellent and will only improve as the team intends to annex their Python code, with C for faster serialization of requests. In addition to an excellent library, the developers have also provided a number of examples which attempt to cover every major area of the library. I have already begun using it in various projects including Hydra, which will be released this month.

Look for more info and updates on the PyAMF project in the coming weeks.