Guide: Note 3 flash to PagePlus with 3G data

Well, that didn’t last long.  After finally getting my Galaxy Nexus flashed to PagePlus and up and running with 3G data, I thought I’d be set for a while.  Then it finally hit me: the galaxy nexus is a piece of crap.  Even when released, it was the result of a 3-way compromise between Google, Samsung and Verizon with the loser being the customer.  Now that it’s pushing 3 years old, retirement is all too gentle a fate.

The Samsung Note 3 is currently the best specced phone available running Android.  It’s also the most expensive.  Fortunately, PagePlus users tend to be frugal, and I’m no exception. I took a chance on a used Sprint Note 3 with a bad ESN (doesn’t matter if flashing it to verizon) and a “Locked SIM.”  A few dings around the bezel (but not a scratch on the screen) only sweetened the deal further.  I made away like a bandit, getting this flagship phone for half its MSRP and nearly the same price as phone subsidized on a 2-year contract.  I just had to make it work.

While this guide follows my adventure with the Note 3, I am trying to make it as generic as possible for flashing any Qualcomm-based phone (Note 1/2/3, S1,S2,S3,S4, HTC One etc…) to PagePlus using DFS.  There are many variables at play here, and some steps may vary by phone, but the overall process should be accurate.  For instance, you may get away using different Radios, PRLs and donor phones than I used.  Then again, you may not.  I’ll do my best to accommodate this.  If all the HA, AAA, MEID, PRL, MSL, SPC jargon is confusing you, check out the end of this post.  I did my best to pass on what I learned.

Prepare your PagePlus Account

  1. Register your phone with PagePlus.  I chose to go through Kitty Wireless, an authorized dealer, as they will take care of monthly billing with the 1200 Plan.  I’m also a member of the Level 2 “Crazy Kitty PIN Rebate Club ” which gives a discounted rate on plans – $26.97/mo vs $29.99/mo – it adds up over time, especially with multiple lines.  This club is only offered at select times during the year, and costs a one-time fee of $100 to join.
  2. Make sure to supply the MEID correctly when your register your device – you need to remove the last digit (because it is 4G capable) for the order to go through.  For example,mine was 990000xxxxxx223.  I supplied 990000xxxxxx22.  Should end up being 14 digits instead of 15.
  3. Wait for the order confirmation email.  You’ll need the following: Phone # (MDN) MIN (MSID), and SID.  For the SID, you need to call PagePlus at 800-550-2436.  Expect to wait a while.
  4. You may or may not need a SIM card.  Furthermore, that SIM card may or may not need to be from Verizon, and it may or may not matter whether it has already been activated.  This totally depends on your phone.  For the Sprint Note 3 that I used, a SIM card was unnecessary.  The verizon model of the same phone however often requires one.  This will require some googling on your part.
  5. For 3G data (upload / download speeds >1mbps, ping <200ms) you will need a “Donor Phone”.  This can be any Verizon dumbphone (that supports 3G) or any 3G ONLY smartphone.  You may already have one in a drawer somewhere.  If not, do a quick google search to make sure the one you are buying is compatible with DFS or CDMA Workshop.  I used a Samsung Convoy (SCH-u640).
    1. You may skip this step, but you will be limited to 1X data (upload/download speeds of 0.1mbps, and most painful – pings of 700-1200ms).
    2. Note: you may also be able to get away with a Sprint phone as a donor, but lets not complicate things, shall we?  Phones are cheap on eBay. 

Ready your Computer

  1. Download this file (45.2MB).  It contains several files necessary for the process.
  2. Install the 32-bit or 64-bit USB drivers for your phone (not provided)
  3. Download DFS from:  Make sure you get DFS and not iDFS.  Install it and create an account – you can get by with the Demo version just fine.
  4. Use the 60008 PRL provided (recommended) or download one here.

Preparing to Flash

Your phone may need to be rooted and/or have an unlocked bootloader.  More importantly, make sure you have the latest ROM of your choice installed before flashing, and MOST importantly, ensure that the baseband / modem (check this in settings / status) is compatible with flashing to PagePlus or your desired MVNO.  I will go through this in the case of the Sprint Note 3 (SM-N900P):

Part 1 – Update Android / ROM, obtain Root, flash Modem

  1. As always, it is a good idea to make a full backup before starting.
    1. TWRP recovery is easy to install via the free goomanager app
  2. I grabbed the latest official (TouchWiz) build of Android 4.4.2  KitKat: N900PVPUCNAB and installed it using Odin 3.09.
  3. Unfortunately, the NAB modem that is installed with this update is not compatible with PagePlus.  No problem, we now just have to flash an earlier version of the modem ONLY (again using Odin just as before), which you can find in the download above (modem.tar).
  4. We can then Root android, again using Odin and loading “CF-Auto-Root-hltespr-hltespr-smn900p”.
  5. This is a good time to disable the pesky KNOX security software, though this step is not necessary for flashing.
  6. Make another backup of your shink new 4.4.2 ROM

Part 2 – Set USB mode to MODEM

  1. Enable USB Debugging.  Settings –> About Phone –> Tap “Build Number” 7 times to enable the development menu.  Then go to it (Settings –> Development) and make sure Enable USB Debugging is checked.
  2. Enable “Install apps from unknown sources” in the security settings.
  3. Install Samsung Android SPC Utility (apk provided) and press “Read SPC” – write this down.
  4. Dial ##3424# (DATA) to enter the PhoenUtil menu, and change the Qualcomm USB Setting to DM+MODEM+ADB or RMNET+DM+MODEM – either will work.
  5. The phone is now ready for flashing.

Reading settings with DFS

Before we start, we need one last password.  For Samsung devices, check here.  The 16 Digit Password that worked for my Sprint Note 3 was 2012112120131219.

DFS – READ; do NOT click write on anything yet

  1. Make sure the SIM card is removed.
  2. Turn on phone and connect to USB – ensure drivers are detected and installed.
  3. Start DFS.  Open “Ports”, select the COM port belonging to the phone.
  4. DFS should establish a connection and read the status and diagnostic info.
  5. Enter your SPC and click the button (log should indicate “UNLOCKED”)
  6. Enter your 16-digit password and click the button (log should indicate “UNLOCKED”)
  7. Go through each section of the equipment and programming tabs and click READ for each subsection.  Then MAKE SCREENSHOTS of your default values.
  8. Go to programming –> General and copy your MEID (14 digits HEX; ignore the two digits in the second box if present)
  9. Turn OFF your phone.  This is important.

Flashing Donor Phone / Obtaining HA, AAA Keys

Put aside your POWERED OFF phone and grab the donor.  Do NOT EVER have the two of these devices powered on at the same time with the same MEID (which they will have shortly).  This would be illegal according to the FCC.

DFS – Flash the donor

  1. Connect your donor phone to your computer and open DFS.
  2. Establish a connection with your phone.  Click Ports, and select the COM interface you donor is connecting on.  This will vary by model.  Here’s what mine looked like:DFS Connected to Samsung Convoy (SCH-u640) - click to enlarge.
  3. Send the SPC code (mine was 000000).  Yours probably is too.
  4. Send the Pwd (mine was 2008110120090528).  This is unique to the model of phone.
  5. Go to the Programming / General tab and READ your MEID.
  6. SAVE THIS – you will want to restore it after finishing.
  7. Write the MEID from your Note 3. (and READ it back to verify it stuck).
  8. Reboot your donor phone and follow the prompt to activate it (or dial *228).  It will now have your PagePlus phone number and should be fully functional.  You have switched phones on a CDMA carrier without having to call support to perform an ESN change.  Epic win.
  9. Verify the 3G icon is present and do something that uses data (mobile web, send an MMS).  This will just ensure the AAA and HA keys are updated.
  10. Connect the donor back to DFS and send the SPC and Pwd again as before.
  11. Go to the Programming / Mobile IP tab and copy the AAA and HA Shared Secrets in HEX format.HA and AAA Shared Secrets
  12. Go back to Programming / General and restore the original MEID.  Read it back to ensure it was written, and reboot or shut off the donor phone.  Its job is finished.

Flashing your Note 3 (or whatever)

Make sure you have your backups / screenshots of original settings!

DFS – Now you can WRITE

  1. Make sure the SIM card is removed.
  2. Turn on phone and connect to USB – ensure drivers are detected and installed.
  3. Start DFS.  Open “Ports”, select the COM port belonging to the phone.
  4. DFS should establish a connection and read the status and diagnostic info.
  5. Enter your SPC and 16-digit password
  6. In Programming / NAM, write the following:
    1. IMSI (leave IMSI T unchanged)
      1. MIN A and MIN D = your MIN / MSID (not phone number)
      2. MCC = 310; MNC=00
    2. Enter your MDN into both the SPC and MDN fields
    3. Set your SID (NID should be 65535)
    4. Check the remaining boxes to match this and then click WRITE:
      DFS: Programming / NAM

      DFS: Programming / NAM

  7. In Programming / Data, write the following:
    1. PPP
      1. SIP NAI: “Your MDN”
      2. UID: “Your MDN”
      3. PWD: vzw (box unchecked)
    2. HDR AN
      1. NAI: “Your MDN”
      2. PWD: vzw (box unchecked)
    3. HDR AN Long
      1. UID: “Your MDN”
      2. PWD: vzw (box unchecked)
    4. I will make a brief note here to remark that some of these values were erased when changing the baseband on my phone (which I did out of order of this guide) and I ended up with this.  It still worked (and I have learned not to mess with things that are working).
    5. Check the remaining boxes to match this (Hybrid preferred can be Enabled):
      DFS: Programming / Data

      DFS: Programming / Data

    6. Click WRITE
  8. In Programming / Mobile IP, write the following:
    1. Under profile column:
      1. Select the first bubble and make active (Right click, enable profile)
      2. Make sure all other profiles are Disabled (Right click, Disable profile)
    2. Under Mobile IP main settings
      1. DS QcMIP: PrefMobileIP
      2. Active profile: 0
      3. Number of Profiles: 1
      4. Retries count: 2
      5. Pre-Reg timeout: 30
      6. Retries interval: ms1750
      7. 2002 BIS MN HA AUTH: checked
      8. Domant handoff: checked
      9. PRQ IF Traffic: unchecked
    3. Click WRITE
    4. Under Selected profile settings
      1. NAI: “Your MDN”
      2. Home address:
      3. Prim HA address
      4. Sec HA address
      5. MN HA SPI set: Check box; 300
      6. MN AAA SPI set: Check box; 2
      7. Reverse Tunneling pref: Check box
      8. AAA Shared Secret
        1. Enter 32-digit value in HEX: Check Box
      9. HA Shared Secret
        1. Enter 32-digit value in HEX: Check box
      10. RM NAI : “Your MDN”
      11. DMU PKOID: 10
      12. DMU MN Auteth: 1.178.7
    5. CLICK ON ” Write current profile settings” – do this 2x to make sure everything stuck
  9. Finally, lets go back to Programming / NAM, and write the PRL:
    1. First READ and then SAVE your current PRL
    2. Then LOAD and WRITE the 60008 PagePlus PRL
    3. The radios will reboot/reset after doing this
  10. Done!  Click Reset in the top right, and restart phone!
    1. Disconnect from DFS and unplug your phone.

Finishing Touches

  1. Once phone is restarted:
    1. Dial ##3282# click Edit Mode
    2. Enter your MSL / SPC code
    3. Click on EVDO then Click on DDTM and make sure it is Enabled. Then hit okay and then hit the back key
    4. Click on eHRPD and set to Off then hit ok.
    5. Click on LTE and Disable that also, and click ok.
    6. Youtube streaming and MMS:
      1. Click Multimedia then click on RTSP/HTTP
      2. RTSP proxy ip:
      3. RTSP proxy port: 0
      4. HTTP proxy ip:
      5. HTTP proxy port: 0
    7. Then click on MMSC menu item
      1. Name: PP (whatever you want)
      3. MMS Proxy: Leave Blank or
      4. MMS Port: 80 or 8080
      5. MMS Protocol: WAP 2.0
    8. Done!  Reboot phone
  2. Verify you can connect to PagePlus (*611) and that you have an EVDO Rev. A data connection.  Use Speedtest to verify 3G speeds / ping.
  3. Remember – NEVER dial *228 or any of its variations unless you wish to repeat all of the above steps again.


Call PagePlus at (800) 550-2436 and verify your ESN / IMEI is correct and in their system.  I had mistyped a digit in mine when flashing the Galaxy Nexus and spent hours trying to figure out why it wasn’t working before realizing it.

3G not working?  Try the following:

  1. Make sure you followed the flashing guide closely.
  2. Your Profile 0 and/or Profile 1 AAA key may be wrong.
  3. You may have wrong APN settings.
  4. Phone network should be set to CDMA. Go to System Settings, More Settings, Mobile Networks, Network Mode should be set to “CDMA”
  5. Try using your AAA password instead of “vzw” in the NAM settings (check the box when entering in HEX).

If all else fails…Nuke it from orbit.  Use Odin to do a full wipe and reflash to stock android and start anew.


What are all those acronyms?

PRL = Preferred Roaming List – essentially a list of towers for the device to use to prioritize communication. Because PagePlus uses Verizon’s towers, a Verizon PRL is needed.

MEID = Mobile Equipment Identifier – Kind of like a MAC address.  This is what your carrier uses to identify your device. Some devices have it listed on the sticker under the battery, while others will have MEID HEX listed instead and will need to be converted to DEC using a MEID Converter. (DEC Example 268435456123456789) (HEX Example A000000A1B2C3D).

MSID = Mobile Station ID – a number that is associated with the home service provider and the wireless phone number. This is reprogrammed when the user changes home service providers. It can also be called the mobile identification number (MIN) and is not to be confused with the mobile device number (MDN) in the CDMA world, which is the device’s telephone number.

MIN = Mobile Identification Number – a unique number associated to your account, using the same area code of your locale. It is required to program your device.

MDN = Mobile Directory Number – your phone number with the area code.

SPC aka MSL – a 6-digit code used to access the programming features of your device. All Verizon devices use 000000 as the SPC code, which makes flashing very easy usually. Sprint devices use a unique code for each device and they can be quite a task to obtain.

HA Shared Secret – A carrier-specific key required to establish a data connection.  Necessary, but not sufficient to get 3G data.

AAA Shared Secret – A device-specific key required to establish a 3G data connection.  This key is unique to each device and is tied to the HA and MEID.

Your thirst for knowledge still unsatisfied?  Check out the FAQ and Manual for DFS.

Oh, and the Galaxy Nexus… it will likely be slimmed down to the bare minimum of essential software and repurposed as a glorified remote control for HTPC / Home Automation use.  Good riddance.

Category: Technology | Tags: , , , ,

22 comments on “Guide: Note 3 flash to PagePlus with 3G data

  1. I think you have a typo.

    Instead of vzn i think you meant vzw for the password.

    I did roughly the same for my sprint S4 SPH-L720 and it worked.

    Tho, I had issues programming it without a sim card. I believe you need a Sprint simcard regardless for this to work without issues.

    • Good catch, I updated the post; it should indeed be vzw. Interesting that the Sprint S4 needs a SIM; I can guarantee that my Sprint Note 3 did not need one – 3G is working great ~2mbps, good pings and no connection issues / 1X fallback.

      • I’m not sure if it is or isn’t. Had issues with data settings not sticking without one and reverting back to sprint ones after a reboot.

      • What donor phone did you use? I have the samsung gusto 2 but it won’t write the meid. Please suggest

  2. I dont know if anyone remebers me but i was in the galaxy nexus flashing post. (What ever you call it) but I just thought I would add that I was able to get 4g lte on pageplus with a sprint note 3!!! I really don’t know how but I did for a client…. I still cant beleave I was able to do that oh and it has a bad ESN on sprint. So ya I know every step I did but I’m not sure I can do it again… Oh and if he went out of lte area it would switch too 3g and the 3g keys I wrote to it disappeared but it still connected. I’m super confused…

  3. Hi With this process can I flash it so that I can use with any GSM carrier in India. I have a sprint Note 3 with bad ESN.

    • No you have to have sprint do a international unlock so since you have a bad ESN you will have to change it to a clean sprint note 3 ESN since you live in India you won’t run into legal problems so get your msl from a app in the play store. One you have it Google how to put it into diag mode and grab the password form the guide above once you have that go to a ESN checker and put your ESN in and change it a little like form xxxxxxxxxxxxx56 to x58 so once you have a clean esn. Replace the bad one with the clean one forth then call sprint and have them do a international unlock. 😀 but since you are not in the USA it might not work… Oh the note has to be on sprint service for 6 months so if it not eligible then try a different esn… 😀 NOTE: DO NOT DO THIS IF YOU LIVE IN THE USA AS YOU CAN/WILL GO TO JAIL AND PAY RIDICULOUS FEE…. STAY SAFE AND ONLY DO THIS IF YOU LIVE INTERNATIONALY… Oh there is no guarantee that this will work buts this is your only way…

  4. thank you SO SO SO MUCH! I spent half of yesterday extracting my 3g keys from a donor, then I went to flash the keys, and I no longer had ANY data whatsoever! I spent hours more trying it again and again, but nothing worked. [The guide I had used QPST, but I also tried DFS on the side, nothing seemed to work.]

    I gave up. Well almost. I considered switching to Sprint, but then I found your guide and it used DFS. I did exactly what you said [Well as close as I could, I think my DFS version was different so there were little variances], but MY 3G works now!! You’re a life saver. Thank you so much for posting this.

    Oh! and I used a bad esn Sprint HTC Evo 4G LTE, and a donor LG Vortex [the vortex was a tough nut to crack, had to use LG’s own special program to get keys extracted].

  5. Hi.

    I’m curious donor phone has to have clean ESN.

    Can I use bad ESN phone as a donor phone?

    Thanks in advance.

    • Yes, you can, because you change donor phone’s ESN before activating it.

  6. Are the finishing touches only to get the stock SMS app to work? I think I read that those steps won’t work on Verizon’s version of the galaxy s3 or it might be that it required root, don’t remember exactly.

  7. First of all, thanks a lot for such a through and complete guide.
    Secondly, I have a question. I tried this guide for my friend’s phone and this works perfectly. She now gets 3G speed on her Galaxy S4 phone. However, when I flash my own sprint note 3 phone, I don’t get any connection. In fact, even when I put my note 3 MEID on my donor phone, I don’t get any data connection on the donor phone as well. Do you happen to know what’s the problem here and why I can’t get data connection neither on note 3 nor on the donor phone?
    I should mention that the donor phone gives me 3G data connection when I put my friends’s galaxy S4 MEID on it.

  8. Is the 16 digit password the same as the unlock code, as in the code you’d put into a Verizon phone to use it on Sprint? I was searching Google for the 16 digit password for the Blackberry Tour and I got a few links for the unlock code, which is also a 16-digit decimal.

  9. Have you thought of or seen anything on flashing the verizon firmware onto the sprint note? This would make text and voicemail much smoother. I had an s3 on PP and thought that using the single verizon text app and not getting voicemail was just a complete hack of a flash. Please let me know if you have a different feel also on your sprint flash to PP. Thanks

  10. How to ensure that the baseband / modem is compatible with flashing to PagePlus ? On my galaxy s4 mini (SPH-L520) Baseband L520VPUBNE3 how to check if it compatible ? If not compatible where to get modem.tar fof my phone? Been searching whole day can’t find anything.

  11. I’m flashing my verizon galaxy s3. I can open the port for my phone, but whenever I enter 000000 into SPC and click the button, the DFS log will tell me device offline. Why is that?

  12. Will this guide work for sprint mega ?

  13. Got donor phone today, everything works. Thanks for tutorial. Any idea how to get rid off no sim card message?

    • I havn’t done this with the no sim message, as I have a gsm sim, AT&T in the phone for a second line, I did get a notifier about a non verizon sim. What I did is long press on the notificaion to get app info, then noted the process.

      I then loaded up titanium backup and froze teh process/app (I think it was Setup Wizard or something along those lines).

      And I havn’t had any more notifications. There’s also a lot of verizon junkware to freeze that clears up a surprising amount of ram.

      This is on a Verizon S3.

  14. Okay i had my note 3 flashed to page plus by a store. My phone was rooted before they flashed it but it don’t seem like it is rooted…and my rom (kit kat killer) is no longer there. Can i root it back without taking the flashed radio?

  15. Hi, can I apply this instruction for Galaxy S4 from US Cellular? Any particular cautions should be take care for this phone before doing this?

  16. People! We’re all killing this post because the poster isn’t going to have time to answer every tech question. He did a fantastic job of giving instructions of what worked for him but it would take an 80 page Wiki to detail it for every phone and every carrier. I’d recommend he, or someone else, kindly put a few links to some ligitimate eBay tech that charge a resonable fee to do this for those of us who are having problems doing so ourselves. I wouldn’t mind paying $60 and waiting a month as long as i knew PayPal had my back if i didn’t get my phone back in 4 weeks and eBay had them at 99% positive reviews with at least 200 feedback. Anyone seen any PagePlus “no dataplan on 4G phone” businesses like this? Someone needs to fix our laws as well. Very few need any stinking 3G or 4G at all anyway with WiFi every 10 feet in even a middium sized city. Totally stupid unless you’re in real estate or something.

Leave a Reply

Your email address will not be published. Required fields are marked *