Softbank X03HT (S730) won't unlock - HTC Wings

This is a copy of a post I made on the general/unlocking board. Posting here in case people are looking only at this forum:
I have just bought a Sofbank X03HT. It is locked up tight. I travel a lot and have SIMs for the places I go most so I want to unlock the SIM. I'd also like to unlock the applications so I can make reg edits as the mood strikes me.
But, none of the tools and/or tricks I have found on here or other sites works. I suspect the issue is with the certification. Have tried the AllowCertificateInstall but it doesn't seem to help. Also tried SurrealNetworksAppUnlock.cab. Again, no joy. Tried SDA Unlocker and the XDA (PDA) tools and tricks. Nada.
Here is what I've got:
Softbank Mobile (Japan)
X03HT (an HTC S730)
Windows Mobile 6 Standard
CE OS 5.2.1947
ROM version 1.71.761.1

Have you tried the deive security manager(maybe not this name)?
A tool in Microsoft Visual Studio 2008 (pro version)
Sorry, I only have chinease version
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

You can download it at
http://www.microsoft.com/downloads/...EC-ED72-4A79-8961-25635DB0192B&displaylang=en
for free 90days trial.
and it allowed you to adjust your handset security settings freely.
I have tried to my Vox, if i set to high level security, i can not run any apps without cert.

Still can not
We need a softbank cert.

Any ideas, anyone? I'm having the exact problem.

i have the same problem too....please help me...

pahpoh said:
i have the same problem too....please help me...
Click to expand...
Click to collapse
I think you must tried to confirm it to Jockyw2001, since only he who knows..

Don't confuse the various "unlock" for the Windows Mobile devices! There are 3 of them and to get rid of some you may need the others removed in advance, depending on the method.
Application Lock: Execution of applications or many other activities is secured on the windows mobile platform. There is a dedicated security model that distinguishes activities (what is done) and roles (who can do it). The assignment of roles to such activities is called policy. These policies are stored in the registry of the operating system and are only in place when the OS is up and running. Look up MSDN for mobile security policy to learn more.
It is common that many users who want to execute special applications want to have their devices "application unlocked".
CID Lock: This ties the ROM of an operator to the device it is loaded. This way the operators make sure that users are not buying a subsidized phone and replace the ROM on them with non customized ones. This lock is treated in the SPL (Secondary Program Loader) and checks on data that are stored encrypted in the ROM outside the normal flash areas. Other ROMs (the OS in them) may not be as restrictive set up on the application lock if you really were after this (I doubt is). Loading any ROM can be achieved by either
Super-CID the phone: This allows the onboard SPL to pass the CID check and continue with the ROM flashing process.
You either replace the operator CID with the Super CID in the encrpyted block by special tools that can calculate the CID and write to the encrypted block (itsutils). To run these tools, the device must be properly application unlocked. Several frameworks have been created to guide this activity, but more recent devices cannot be cracked this way any more to my understanding.
Or you can have a device be temporarily have the "Super CID rights by inserting a "GoldCard" into the device. This is a normal memory card which has a device specific key written to the bootsector of the card. The bootsector written to the card is specific to the HW serial number of the memory card. The only tool I know that can write this is "PSAS" from http://psas.revskills.de. You need to have a working application unlocked Windows Mobile device for that as also here itsutils are used for some parts of the job.
Replace the SPL
either temporarily (jumpSPL, HARET) by loading the code for upgrade in the RAM
or permanently by flashing the SPL to the device. This requires one temporary use to have it done permanently, of course.
SIM lock. This is most commonly know "lock" as it links the device usage to the SIM card of an operator. I am not aware of the reference that this linkage is done (but I suspect IMSI + parts of the MSISDN), but the final place to store that is done again in an encrypted area of the ROM that is outside any normal flash region, so it cannot be removed with any ROM update. Also here several services exist from people that know how to deal with encrypted data. A well known user is jockyw2001 for that, but there also exist commercial services that do that for reasonable prices on older devices. I made good experience with http://www.imei-check.co.uk/ who are very responsive and as I understood their service will both SIM unlock and Super-CID your device (at least for Tornado).
Be warned: messing with the encrypted block in an unqualified way (for CID or SIM unlock) may leave your device useless for telephony use. Inserting a SIM in the device will return the message "data crashes, please contact your service center" when you try to get radio access.

tobbbie said:
Don't confuse the various "unlock" for the Windows Mobile devices! There are 3 of them and to get rid of some you may need the others removed in advance, depending on the method.
Application Lock: Execution of applications or many other activities is secured on the windows mobile platform. There is a dedicated security model that distinguishes activities (what is done) and roles (who can do it). The assignment of roles to such activities is called policy. These policies are stored in the registry of the operating system and are only in place when the OS is up and running. Look up MSDN for mobile security policy to learn more.
It is common that many users who want to execute special applications want to have their devices "application unlocked".
CID Lock: This ties the ROM of an operator to the device it is loaded. This way the operators make sure that users are not buying a subsidized phone and replace the ROM on them with non customized ones. This lock is treated in the SPL (Secondary Program Loader) and checks on data that are stored encrypted in the ROM outside the normal flash areas. Other ROMs (the OS in them) may not be as restrictive set up on the application lock if you really were after this (I doubt is). Loading any ROM can be achieved by either
Super-CID the phone: This allows the onboard SPL to pass the CID check and continue with the ROM flashing process.
You either replace the operator CID with the Super CID in the encrpyted block by special tools that can calculate the CID and write to the encrypted block (itsutils). To run these tools, the device must be properly application unlocked. Several frameworks have been created to guide this activity, but more recent devices cannot be cracked this way any more to my understanding.
Or you can have a device be temporarily have the "Super CID rights by inserting a "GoldCard" into the device. This is a normal memory card which has a device specific key written to the bootsector of the card. The bootsector written to the card is specific to the HW serial number of the memory card. The only tool I know that can write this is "PSAS" from http://psas.revskills.de. You need to have a working application unlocked Windows Mobile device for that as also here itsutils are used for some parts of the job.
Replace the SPL
either temporarily (jumpSPL, HARET) by loading the code for upgrade in the RAM
or permanently by flashing the SPL to the device. This requires one temporary use to have it done permanently, of course.
SIM lock. This is most commonly know "lock" as it links the device usage to the SIM card of an operator. I am not aware of the reference that this linkage is done (but I suspect IMSI + parts of the MSISDN), but the final place to store that is done again in an encrypted area of the ROM that is outside any normal flash region, so it cannot be removed with any ROM update. Also here several services exist from people that know how to deal with encrypted data. A well known user is jockyw2001 for that, but there also exist commercial services that do that for reasonable prices on older devices. I made good experience with http://www.imei-check.co.uk/ who are very responsive and as I understood their service will both SIM unlock and Super-CID your device (at least for Tornado).
Be warned: messing with the encrypted block in an unqualified way (for CID or SIM unlock) may leave your device useless for telephony use. Inserting a SIM in the device will return the message "data crashes, please contact your service center" when you try to get radio access.
Click to expand...
Click to collapse
ok...
Tell me.. if i don't have a SHIP ROM, then what i must do??
How to unbrick my device -> Monet??

Related

[HELP PROJECT] "Data Crashes" Project [HELP PROJECT]

DATA CRASHES PROJECT:
If you have a G3 device in "Data Crashes" state check the CID collection to find the matching file to flash. Read bellow for the complete explanation about the theory and the procedure.
Theory:
Basis:
It's a known fact that the Wizard (and maybe Prophet) uses a DES encryption key from a list of 100 possible keys to decrypt the info of a CID block which is then verified by the cprog.exe utility. The 'key index' (list position) is calculated using the values from the DOC chip uniqueid which is a permanent value and the CID block must have been encrypted with same key otherwise the phone will never get to understand it and go in "Data Crashes" mode.
Theory:
There are two possibilities to get the "Data Crashes":
1- Corrupted CID block with invalid checksum;
2- Good CID block encrypted with different key index other than the one generated by the DOC chip uniqueid.
In scenario 2 if one is able to flash a good CID block encrypted with the correct key index then the problem will go away.
Purpose:
Since i've tested myself that it's possible to flash another phone's CID block with same key index and have phone work normally i purpose to make a collection of 100 good SuperCID blocks to cover all the 100 DES keys.
Even though only G3 devices downgraded to SPL 1.x allow to flash the CID block i won't discourage G4 members to contribute their CID blocks as they can be used in G3 devices (tested myself)
So i ask you to please contribute with dumps (unlocked or not) from the CID block of your devices.
In case you don't know how to provide what i'm looking for this is how to:
HOW TO SHARE:
1- Make the dump:
Get Wizard Service Tool (LINK) and use the "Read ROM" button to read the CID block (see pic below)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
or... get itsme's pdocread.exe and make the dump with: pdocread.exe -n 1 0 0x10000 [filename.bin] using windows 'DOS' console (command)
2- Read the key index: (optional)
Use Wizard Service Tool and read "Device Info" to check the key index of your phone and post it along with the dump.
3- Share it:
Removed the email address as i no longer have time to assist this project (sorry)
You can still leave the file here as i get mail notifications but...
NOTE: For all those that have used lokiwiz you might have the file already since lokiwiz makes a backup and also creates new (unlocked) file to flash to the phone. It's the one of the *.bin files.
For all those afraid of sharing the file i assure you that there's no danger since i can mask the CID IMEI present in the dump so that it shows all FF's and your anonymity is guaranteed
HOW TO FLASH:
1- Get the CID file corresponding to your wizard's key index:
Use Wizard Service Tool and read "Device Info" to check the key index of your phone and, if you're lucky, get it from the collection in post bellow
2- Upload CID file with Wizard Service Tool:
Select "Write ROM" button and then "CID block (bdk 1)" to flash the file already in your hard-drive (SPL must be 1.xx !!!!)
3- Soft-reset the phone:
final step either via WST button or wizards side hole
mestrini
The theory has been confirmed!
2007/07/04 - emiconi recovered his wizard for FREE by flashing the apropriate CID block (http://forum.xda-developers.com/showpost.php?p=1348533&postcount=41 )
2007/10/18 - Another one bytes the dust. Kheops_974 fixed his phone after 3!! months of waiting for key #1
(http://forum.xda-developers.com/showpost.php?p=1594845&postcount=186)
2007/11/01 - And one more for the fixing count (http://forum.xda-developers.com/showpost.php?p=1630368&postcount=203) hehe
2007/11/28 - Once again a phone comes back to life after a LONG time of inactivity (http://forum.xda-developers.com/showpost.php?p=1697325&postcount=226)
2008/09/25 - Another success story (http://forum.xda-developers.com/showpost.php?p=2689813&postcount=303)
The list shows the keys that STILL HAVEN'T BEEN PROVIDED!!
If you have them please share the keys listed bellow:
key #07
key #09
key #13
key #17
key #29
key #33
key #43
key #63
key #67
key #71
key #85
MISSING = 11
key #80 - not released yet (having problems to handle it)
TOTAL = 89
thanks
mestrini
EDIT (2008-03-31)
Attached is the 8th collection with the 88 files gathered so far and all with MASKED IMEIs . They are spanned in 5 parts for easier downloading and with a max of 20 files per archive (starting at 0). So if you want to get a specific key just make the math
Someone noticed me once that some files are still SIM locked. It isn't a big deal since with bootloader 1.xx you can easily unlock it with Wizard Service Tool
As always you use these files at your OWN RISK but feedback is always VERY welcome
cheers
I apologize to all those that sent and also others that keep sending keys for not responding to mails or acknowledge the offerings but i haven't had much time to do it (had mails from November...)
Key index #94 attached -but removed later. But badly need CID block for key index #66
Someone could please post and that will be great help.
Thanks - Nishad
Great and thanks for mestrini...
Thanks mestrini for sharing this knowledge
nishadks said:
Thanks mestrini for sharing this knowledge
Click to expand...
Click to collapse
i invite everyone to share his CID dump to cover the needed blocks so as to solve this noisy problem totally
dr.moh said:
i invite everyone to share his CID dump to cover the needed blocks so as to solve this noisy problem totally
Click to expand...
Click to collapse
thanks for helping this cause m8s
i really hope this proves to be a valid theory so that G3 devices can have a free solution for this problem.
cheers
mestrini
here is my cid-block (super CID) key index 94.
(key-index as showed by Mestrini's tool)
Thanks for trying to solve this problem mestrini!!
EDIT: removed the file since Mestrini downloaded it already.
Come On People!!
Come on you guys!! This is a community forum and it shouldn't be only the ones with broken phones to try to help each other.
Everyone with working phone is a potential helper and should consider contributing to this task by providing a good/unlocked CID dump of a key index not yet provided.
Who doesn't like to get solutions for free? So get your wizards and make some dumps to share.
Right now the most wanted key indexes are: 66 for nishadks and 81 for peran.
Thanks in advance fellow members
Hi,
please send ur key indexes.
I need key index 81 very urgent. Plz help me.
Key Index #93 CID block
Anything I can do to help the geniuses who give freely of their time (and brains) here sounds good to me.
Come on guys. Send ur key index !!! PLZ
need key index #28 urgently
regards.
raid232 said:
need key index #28 urgently
regards.
Click to expand...
Click to collapse
Which one do you have now? It may not work for you but may be good to fix another phone
G4 Key Index # 70 Available
Sent to your mailbox mestrini, hope it helps to someone.
luiggi said:
Sent to your mailbox mestrini, hope it helps to someone.
Click to expand...
Click to collapse
tx for sharing it m8
and i must tell you guys that G4 CID blocks can be used in G3 devices. I just flashed my G3 (index88) with luiggi's G4 (index70) file and i got the expected "Data Crashes" message, nothing more
So what i'd like now is for other members with G4 devices to share their CID blocks; and it does not matter if the phone is CID locked since i can remove SuperCID the file and it will be good for a G3 owner to use
tx
I expected some more user participation.
Especially because it's a safe procedure, and done in a minute.
So people, chip in and contribute to this project.
Here is CID Block with key index #82 Block index 227. My CID is Locked.
I hope i'm helping
key index#27
got a index from a friend.
here it is.
tx freeyayo50, your CID block is already in first collection
tx to Peran281 and Zzan who just shared another two (#27 and #00)
and tx AGAIN to Luiggi who has supplied two more (three on his own!) (keys #10 and #40)
cheers
Here's mine, Key Index: 96

Flash ROM problems - it refuses to flash

Ok, I am having a difficulty in flashing ROM using MaUpgradeUt_noID.exe and/or BaUpgradeUt.exe
Using MaUpgradeUt_noID.exe
I have the system rom (Aku's version) and a radio rom (1.5). Next, I run MaUpgrade tool; it detects the device flash as follows:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(Okay, you might have questioned why is the device v5; that's because it worked before with baupgradeut tool, but right now, it doesn't work anymore and I wasn't sure how I managed to get it to work in the first place. The main reason I wanted to upgrade again was the radio rom (the connection is really bad) and the transcriber failed to function properly as an extended rom but that was like months after I did this. I often had to reset the device to fix those issues.)
Then after pressing Next, ActiveSync (I tried final version 4.5 as well as an older version 4.2 - both failed) would then get disconnected and ma utility will give me a Connection problem error as follows. I have to reset the PDA device to get activesync reconnected.
Using BaUpgradeUt.exe
Now this is the annoying part. I loaded the GetDeviceData.exe on the PDA and obtained the following:
Code:
P H 2 0 B 1 W W E AT%CID? 5 . 0 4 . 1 0 . 1.02.10 % 4
Removing all of the spaces, I get something like this:
Code:
PH20B1 WWE AT%CID? 5.04.10. 1.02.10 % 4
I wasn't able to find the device operator. So I just edited EditFix.bat like this (and of course, I run this batch - both files are modified (nk and radio_ ones)):
Code:
xda3nbftool -sd PH20B1 -sl WWE -so "" ms_.nba
xda3nbftool -sd PH20B1 -sl WWE -so "" nk.nba
xda3nbftool -sd PH20B1 -sl WWE -so "" radio_.nba
where I also tried to replace "" with T-MOB101, XGULB001, and XGULA001. (since the device is a Siemens SX66 purchased on ebay) All failed and returned a model error.
Is there anything I should do?
Your operator code seems to be deleted (should be sth like T-MOB101 - read here: http://wiki.xda-developers.com/index.php?pagename=GetDeviceData ). Now you can only use MaUpgradeUt_noID.exe untill you repair it (anyway operator code is not needed after all) by installing ROM with correct Operator code for your device (if you know/remeber it) set by operator or you using xda3nbftool.
Apart from this, you seem not to follow the procedure: you should put BA in Bootloader mode, not leave ActiveSync mode when you initiate upgrade.
Please post your results here, when you finish.
pichus said:
Ok, I am having a difficulty in flashing ROM using MaUpgradeUt_noID.exe and/or BaUpgradeUt.exe
Using MaUpgradeUt_noID.exe
I have the system rom (Aku's version) and a radio rom (1.5). Next, I run MaUpgrade tool; it detects the device flash as follows:
(Okay, you might have questioned why is the device v5; that's because it worked before with baupgradeut tool, but right now, it doesn't work anymore and I wasn't sure how I managed to get it to work in the first place. The main reason I wanted to upgrade again was the radio rom (the connection is really bad) and the transcriber failed to function properly as an extended rom but that was like months after I did this. I often had to reset the device to fix those issues.)
Then after pressing Next, ActiveSync (I tried final version 4.5 as well as an older version 4.2 - both failed) would then get disconnected and ma utility will give me a Connection problem error as follows. I have to reset the PDA device to get activesync reconnected.
Click to expand...
Click to collapse
Hello,
I've the same 101 error...
I don't really understand how to find a solution to upgrade without that problem...could you help me ?
Once I had a problem like this one and I figured out that I could not flash my device + radio at the same time.
Try removing the radio.nbf from the folder where MaUpgradeUt_noID.exe and then try to flash your device.
If it works, then remove the nk.nbf from the folder, put back the radio.nbf and try to flash it.
Tks.
I've put a topic for that.
It seems to be a Vista OS problem...
eleger91 said:
Tks.
I've put a topic for that.
It seems to be a Vista OS problem...
Click to expand...
Click to collapse
I confirm everything. Same problem for me with Vista. Upgrade is possible only under Xp. Maupgrade is not compatible with Vista. Someone should make a Vista version of it.
Nope not only vista. my xp home is having excatly the same problem. Completely stuck now and getting PreSetUSB along with other error msgs now on the device.
hi all of you
how can I fix sam problem
I'm having the exact same problem as you guys. anyone managed to find a work around to it ?
try this workaround...
1. avoid Vista... use XP
2. flash in BOOTLOADER mode. (press and hold Record+Powerbutton then softreset) then just ignore if the Device info FROM is missing... just click upgrade.
Hi Silver Samurai,
I am flashing in Winxp using bootloader mode and Maupgrade. Doesn't seem to work. I have followed everything in the wiki step by step. Such as disabling activesync.
Really don't know where i have gone wrong.
mtnbikefreak said:
Hi Silver Samurai,
I am flashing in Winxp using bootloader mode and Maupgrade. Doesn't seem to work. I have followed everything in the wiki step by step. Such as disabling activesync.
Really don't know where i have gone wrong.
Click to expand...
Click to collapse
what error numbers are you getting?
when does it fail?
Well i make a hard reset (No for the first option and yes to the 2nd and 3rd options.) After that leaving it in bootloader mode - showing serial and bootloader version number v2.08.
I make sure that activesync (usb connection is disabled). Close wcecomm.exe and other files related to activesync in taskmanager. Connected the usb cable and it changes from serial to usb. Invoked the Maupgrade noid.exe. It hangs there indefinately for more than 30 mins showing the screen that it is checking the xda. If i pull the cable out, it immediately shows device error.
I know that there is nothing wrong with the cradle as i can connect to activesync in normal mode and install programs / files.
I can still boot up after that with wm2005 helmi. Cannot seem to erase the rom. Funny thing is that with wm2005 my sd card cannot be detected. Previously with wm2003 it can be detected. However when the screen is off, and when i insert the sdcard, it does turn on. Likewise when i remove the card and the screen is off, it would also come on. But that is a total different aspect altogether. Anyway i figured that if i can reflash to the official wm2003 rom, it would solve that problem.
Sorry for the wall of text, but i just wanted to fully describe the problem i am facing. Could it be that the DiskOnChip is already corrupted ? Don't think that it's the Intel SRAM/Nand Flash chip as it's only 128Mbits. which only stores the bootloader.
is there an SD Card inserted when you are trying these procedures?
can you try both with or without it?
try without an SD first
please post your result.
Yes i have tried both with sd card and no sd card. If the SD card is inserted, in bootloader mode, the serial won't change to usb until i eject the sdcard. The screen would just get stuck showing the msg, checking the xda.

[UPDATE April 3rd] WST v4.2.2 - Wizard Service Tool

Ok guys, here you have latest version of my tool
I decided to open a new thread because the original one was getting too big (my opinion at least) so if you want to know more about first versions then visit the old thread: http://forum.xda-developers.com/showthread.php?t=295038
EDIT: (2008-04-03)
I know it's been a while but things kinda busy lately... but here you have released the latest update which includes the changes present in the log below.
Change log:
v4.2.2 (2008-04-03)
-Added some "Device info" routine error checking;
-Replaced "Exit" button that was removed in last version (got too used to it);
-Fixed bugs with non-declared variables;
-Added possibility to try CID unlocking if IPL and SPL versions differ (IPL 1.xx & SPL >2.xx) due to failed downgrade (which has been proved to work HERE . Thanks Monktrump )
-Changed PagePool routine to allow editing value even if only one pattern is found (tested successfully in "Slim Edition v2.2" and "Snn Edition")
v4.2.1 (2007-10-10)
-Fixed User Area reading routine for G4 (size is different from G3);
-Fixed RADIO reading routine for G4 devices (thanks to itsme, once again);
-Fixed "Device Info" routine to display RADIO values for G4;
-Fixed "Device Info" HardSPL display info (wasn't showing values);
-Fixed "DOC has no value" bug;
-Fixed crash upon canceling 'device detection' routine;
-Removed "Exit" button because of above bug;
v4.2 (2007-10-05)
-Changed the version's numbering system. WST is no longer beta as someone pointed out so i remove the leading '0';
-Added HardSPL detection (checks for the string "Olip") for G4 devices;
-Fixed User Area reading (partition handle recognition wasn't working for G4 devices);
-Added size and signature check to OS.nb files to be flashed (safer to write OS now!);
-Improved Write ROM routine to display the progression of OS and Ext_ROM zones writing (no more freez&wait);
-Fixed a bug in key index (CID) routine that caused errors in key#22;
-Fixed a bug that was leaving WST process running even after closing program in some occasions;
-Added a 10MB option to the Poolpage routine;
v0.4.1.0 (2007-09-19)
-Fixed a bug in read/write ROM routines where a variable wasn't initialised properly and would crash program;
-Restored some commented code that prevented SPL check in CID unlocking routine (didn't check G4 nor G3 SPL 2.xx);
-Fixed IPL dump from memory to generate an exact copy of an original IPL;
-Added code to Extended_ROM option to COPY files to HDD (forgot to move code while porting functions);
-Improved 'PagePool' routine code (more time to read program messages);
-Added IPL version to "Device Info" routine;
-Added 'Check nk.nbf' routine (to know what chunks are in a nk.nbf)
v0.4.0.0 (2007-09-12)
-Cleaned up some code and fixed a lot of errors resulting from new REXX interpreter version;
-WST is now PORTABLE, i.e, no longer requires the install of Reginald interpreter and doesn't write to registry;
-Replaced the log window (list control) with a text entry to allow selecting and copying the information;
-Added more info to "Device Info" feature: cleary states if it's a G3 or G4, shows date of SPL, shows name and -visibility status of extended_rom;
-Removed 'Repair IMEI' section and placed the button in 'General options' (works the same way as previous);
NOTICE: Thanks to itsme that updated his itsutils it's now possible to change IMEI in G3 without the need to downgrade to 1.xx and also on G4 CID unlocked!!!
-Eliminated the Extended_ROM window and moved the functions to the main script;
-Added 'Format ROM' option to ext_rom;
-Added a patching for the PagePool that doesn't rely on a fixed address (looks for pattern);
-Added option to read IPL from memory;
-Fixed the read SPL routine to detect G3 or G4 device (now produces a replica of the SPL.nb);
-Added an option to read ALL ROM sections at-once and also automatic file naming;
-Fixed an issue with files being saved with spaces in their names (pdocread limitation, though);
mestrini
PS:
latest version ZIP already includes the windows DLL (msvcr71.dll) needed by Win2K and XP not up to date...
EDIT:
I had to remove version 4.2.2 from April 2nd to remove a debugging instruction i forgot and that was crashing WST.
I didn't change the version number so check if you have latest 4.2.2 from April 3rd!!!
EDIT2: (2008-04-12)
I removed v4.2.1 as the downloads kept increasing which i assume may be from external linking. This way people weren't getting the latest version
reserved for pics
Pictures of features:
1- PagePool
You can use the button to change the page pool that will take effect after a soft reset. if you just want to check the value you simply cancel the procedure and nothing will be written to ROM
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2 - Check DOC chip version (G3 or G4??)
Select the "Device Info" button and wait for program to finish. Once finished check SPL version and the info about the Gx generation of your device.
3 - Check CID lock status
Use the "CID Actions" button and then the "Read CID block" from the drop down list (selected by default)
Once finished you'll be presented with the CID value (referring to the service provider code) and the corresponding status (unlocked in this case)
Enjoy...
Thanks mestrini!
It is fully working now without any problem.
Thanks Mestrini !
Great tool you got there man. Congrats !
Please read this post...can your tool read the build number wrong ?
anichillus said:
Great tool you got there man. Congrats !
Please read this post...can your tool read the build number wrong ?
Click to expand...
Click to collapse
Yes, it sure is possible because my tool grabs some some .dsm files from the \Windows folder and reads the build values present inside. I guess that not all the .dsm files have the build updated or are used from older builds. It's done this way because some kitchen builder (can't recall who) directed me that way.
Now if anyone knows a 'safer' way or a specific .dsm file that has the most recent build value i'll update my tool.
Anyway, thanks for the feedback m8s
Am I missing something?
I'm planning to load WM6 on my Wizard (T-Mobile MDA Vario II) but wary of bricking it, so when I came across references to WST I was very pleased. I'm hoping it will let me take a backup of the existing ROM that I can reload if my attempts at a WM6 install fail.
I downloaded WST and read the readme.txt file. I ran the installer, checked my Wizard is connected via USB and ActiveSync is happy. All is good so I fire up WST.
It looks great - very neat and no confusing stuff in the UI. Well done!
I note the bit about needing to enable RAPI stuff before anything else, so that's what I do. The tool seems to connect and run the cabs and then completes without reporting any problems, but then if I try any other option I get a message telling me a device was detected but one (or both) of RAPI
Communications and Applications Policy isn't enabled.
Do I need to do something else before I can use this tool?
Can I enable RAPI maually outside of the tool before I begin?
That is strange. Have you tried closing WST and then open it again? That's the problem of most cooked ROMs nowadays that are already RAPI enabled and it's possible to let something pass by when writing that procedure.
That is strange. Have you tried closing WST and then open it again? That's the problem of most cooked ROMs nowadays that are already RAPI enabled and it's possible to let something pass by when writing that procedure.
Click to expand...
Click to collapse
I tried that. My current ROM is not cooked. It's the one shipped by T-Mobile (I'm scared of breaking anything so I want to take a backup of this ROM before I try swapping it out for WM6).
Since then I've also done a soft reset on the Wizard and a reboot on my PC (Win XP Pro) but I get the same problem
There doesn't seem to be anything in the options or setup within the device to enable RAPI or unsigned apps. Do I need a registry editor too?
Just in case it's significant:
ROM version is 2.21.2.6 WWE
ROM date is 3/9/06
Radio version is 02.19.11
Protocol version is 4.1.13.09
ExtROM version is 2.21.2.109
Thanks for supporting WST - this is great!
Sorted!
I copied the .cab files from the WST folder (created when I installed WST) on to my Wizard and ran them from the Wizard UI.
Now WST can talk to my device! Yayy!
Yes I am missing something.
When I read the original messages I misunderstood the purpose of WST. I got the idea that I'd be able to copy my current ROM as a backup before I started fiddling (loading WM6).
Having got WST to talk to my device I now find I was mistaken. There doesn't seem to be the option of capturing the whole ROM for use as a backup, so I'm no nearer (except I do have a neat way to interrogate my device now - that's cool!)
So, what do other people do about safeguarding their original setup - or at least making sure they will be able to reload an official ROM if necessary - before trying new ROMs?
Am I just being over-cautious? Does everyone just jump in without thinking about a safety net?
Tulaine said:
When I read the original messages I misunderstood the purpose of WST. I got the idea that I'd be able to copy my current ROM as a backup before I started fiddling (loading WM6).
Having got WST to talk to my device I now find I was mistaken. There doesn't seem to be the option of capturing the whole ROM for use as a backup, so I'm no nearer (except I do have a neat way to interrogate my device now - that's cool!)
So, what do other people do about safeguarding their original setup - or at least making sure they will be able to reload an official ROM if necessary - before trying new ROMs?
Am I just being over-cautious? Does everyone just jump in without thinking about a safety net?
Click to expand...
Click to collapse
You can backup your ROM but you must do it in several steps (or one step but will several files)
Later you can pack the files inside an RUU and flash back to phone or use WST to flash them back (OS & Ext_Rom at least)
Installed and running. Using the Start|Programs|Wizard Service Tool!Wizard Service Tool shortcut, found that I needed to modify the working folder, that is, remove "files" from the path. Running XP Home SP2. Installed to defaults.
Like the ability to save the Device Info to the clipboard. Useful as is providing a filename template including the date when saving ROM Zones
mestrini said:
You can backup your ROM but you must do it in several steps (or one step but will several files)
Later you can pack the files inside an RUU and flash back to phone or use WST to flash them back (OS & Ext_Rom at least)
Click to expand...
Click to collapse
A few questions about using WST to upgrade a Wizard, getting close to doing so on a G3 with the current ROM versions 1.-- that is now CID unlocked.
From what I am reading here WST will write ROM Zones as and when but should care be taken such as upgrading the IPL/SPL zones at the same time between soft resets?
I also note previous comments that the version relationship between the IPL/SPL and the OS should be maintained but looking at some of the cooked ROMs these sometimes look to mix the version 2 and 3 IPL/SPL zones with the different OS versions including whether it has WM5 or WM6. Indeed, have read that some feel that there is limited value in going above the version 2.-- IPL/SPL zones. Is there a rule of thumb here that can be checked, versions of particular files in the OS against the version of IPL/SPL or is it only version 1.-- IPL/SPL that can cause dependency problems with later OS ROMs?
Thanks for every ones contributions here.
mick.j said:
Installed and running. Using the Start|Programs|Wizard Service Tool!Wizard Service Tool shortcut, found that I needed to modify the working folder, that is, remove "files" from the path. Running XP Home SP2. Installed to defaults.
Click to expand...
Click to collapse
There was a similar complaint in version 0.2 but i don't see how that "files" ended up there. It installs perfectly on my system. Please paste here the full path you got.
mick.j said:
A few questions about using WST to upgrade a Wizard, getting close to doing so on a G3 with the current ROM versions 1.-- that is now CID unlocked.
From what I am reading here WST will write ROM Zones as and when but should care be taken such as upgrading the IPL/SPL zones at the same time between soft resets?
I also note previous comments that the version relationship between the IPL/SPL and the OS should be maintained but looking at some of the cooked ROMs these sometimes look to mix the version 2 and 3 IPL/SPL zones with the different OS versions including whether it has WM5 or WM6. Indeed, have read that some feel that there is limited value in going above the version 2.-- IPL/SPL zones. Is there a rule of thumb here that can be checked, versions of particular files in the OS against the version of IPL/SPL or is it only version 1.-- IPL/SPL that can cause dependency problems with later OS ROMs?
Thanks for every ones contributions here.
Click to expand...
Click to collapse
The big difference lies between 1.xx and 2.xx. Everything else should be safe. WM5 or WM6 can be run with IPL/SPL 2.xx or 3.xx and also with any 2.xx radio
But since your device is CID unlocked you should consider upgrading your Wizard via RUU
WST
This program is Awesome many many thanks!
The last version before this one worked perfectly.
mestrini said:
There was a similar complaint in version 0.2 but i don't see how that "files" ended up there. It installs perfectly on my system. Please paste here the full path you got.
Click to expand...
Click to collapse
Checked the WST folder in Program Files and it had the following folder tree.
Wizard Service Tool\
Wizard Service Tool\Files\
Wizard Service Tool\Files\Temp\
Wizard Service Tool\Files\ Files\
Wizard Service Tool\Files\ Files\Temp\
Un-installed and deleted the respective folders in Program Files. Reinstalled and the "start in" path is "C:\Program Files\Wizard Service Tool" and opened OK whereas in the previous install it had been "C:\Program Files\Wizard Service Tool\files"
Looks like some residue from the previous version may have affected the path.
The big difference lies between 1.xx and 2.xx. Everything else should be safe. WM5 or WM6 can be run with IPL/SPL 2.xx or 3.xx and also with any 2.xx radio
But since your device is CID unlocked you should consider upgrading your Wizard via RUU
Click to expand...
Click to collapse
I was looking to bypass installing a full ROM to update Radio, IPL and SPL and then installing an OS of choice but your advice is well taken and thanks for clarifying the version issues that I had.
Regards.
GateArray said:
The last version before this one worked perfectly.
Click to expand...
Click to collapse
That is not very helpful. Now i know there's a bug in it but not what it is or how to try and fix...
Pls give more details as how you got there and what did you do
mick.j said:
Un-installed and deleted the respective folders in Program Files. Reinstalled and the "start in" path is "C:\Program Files\Wizard Service Tool" and opened OK whereas in the previous install it had been "C:\Program Files\Wizard Service Tool\files"
Looks like some residue from the previous version may have affected the path.
Click to expand...
Click to collapse
What OS are you running? XP Pro English? It may also be related to a specific OS version? Anyway, I'm glad you sorted it.
mestrini said:
That is not very helpful. Now i know there's a bug in it but not what it is or how to try and fix...
Pls give more details as how you got there and what did you do
What OS are you running? XP Pro English? It may also be related to a specific OS version? Anyway, I'm glad you sorted it.
Click to expand...
Click to collapse
Here I am
SO: W2000 server english
I have tried to re-install ver 0.3.0.3 and it works fine
I also have tried to "clean" old version before install 0.4.0.0.... same problem
I tried to uninstall the compiler REXX from CP
same result still....
Tomorrow next tests.
Hold. You're getting it as soon as WST starts?

Help out OliNex / HARDSPL development by looking up your internal storage brandname

Hi There!
As requested in this topic, I promised to write an tutorial regarding on how to find your internal memory brand (to be clear, NOT your SD Storage Card brand).
This is important because there are ALOT of Rhodium Devices out there which use "Samsung" internal memory and OliNex needs to find a device which uses Hynix (or any different then samsung_kby00xxx) so they can test HardSPL for the Rhodium with it.
So...In short, read the tutorial below if you wan't to help out hardspl development AND if you're willing to, if you have internal memory that's from Hynix (or any different then samsung_kby00xxx), act as a tester for their HardSPL.
Cmonex also wrote a very short tutorial using a different program, you can scroll down a bit and read it or click here.
Originally Posted by cmonex
[SIZE=+3]PLEASE STOP POSTING YOUR FLASH INFO IF YOU ONLY HAVE THE samsung_kby00n00hm[/SIZE]
...because it gives no new information to anyone, or anything useful.
The Tutorial:
Requirements:
QMAT
Windows Mobile Device Center 6.1 for vista or ActiveSync 4.5 for Windows XP
USB Cable for connecting your phone with your pc
Warning:
I'm in no way reliable if you screw your phone up...altrough I seriously doubt that you can actually screw anything up using QMAT and just these instructions.
Step 1
Note:
As I'm personally using Vista x64 I can't explain in full length on how to disable USB Connections in ActiveSync for Windows XP.
Note2: Begin with your device NOT connected to your pc.
First we are going to disable USB connections so QMAT can succesfully communicate with your device.
To do this, open the Windows Mobile Device Center.
Click on "Mobile Device Settings" and then click on "Connection Settings".
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Untick "Allow USB Connections" in the new window that just popped up.
Click on "Ok" and then close Windows Mobile Device Center.
Step 2
Enter bootloader mode with your device, DO NOT CONNECT YOUR DEVICE JUST YET!. To do this:
* Remove the stylus from your phone then remove the back cover from the phone.
* Hold the Volume Down button.
* Use the stylus to press the reset hole.
* Or if the device was powered off, hold the volume down button and then press the power button to turn the device on.
You should see "Serial" at the bottom of the screen.
Step 3
Connect your phone to your pc using a USB cable, any USB to Mini-USB cable should be fine, just to be on the safe side you could use the USB cable from the original packaging.
The word "Serial" at the bottom of the screen should turn into "USB", also if this is your first time entering bootmode and connecting your device to the pc it should install some drivers and stuff...this is normal
Step 4
Now the real stuff begins....
Open up QMAT
Click "Hardware Forensics" at the top of the program.
Click on "Use Mobile Ports" at the sub-menu which just appeared.
Click on the tab "Modem Port (Async)"
Click on either Start USB (Vista) if you have vista, or Start Serial (XP) if you have XP.
If everything wen't ok the button you just clicked turned into "Stop USB". Just don't click it just yet
In the Textfield at the left of the buttons you type in:
"info 8" (without the quotes afcourse...) and then press return (enter).
All kinds of information should start popping up in the big textfield below.
Scroll up....and you should see something like this:
Code:
info 8
--- 2K bytes sector version ---
DEVICE NAME=*YOUR INFO HERE*
DEVICE ID=*YOUR INFO HERE*
DEVICE MAKER ID=*YOUR INFO HERE*
PAGE SIZE=*YOUR INFO HERE*
TOTAL PAGE SIZE=*YOUR INFO HERE*
BLOCK COUNT=*YOUR INFO HERE*
BLOCK PAGE=*YOUR INFO HERE*
This is what it displayed with me:
Your brand is stated after "Device Name". Now...please reply with this information if the one you're seeing is displaying ANYTHING else then samsung_kby00xxx (specially if it's stating Hynix)
You can select the text needed and copy it to a notepad file or any other text-file...or this forum afcourse
After you're finisht, hit "Stop USB" and close down QMAT.
Safely remove your device from your pc, reset it and it should start up again as normal.
Re-enable usb connection in the Windows Mobile Device Center.
Thanks to Olipro for personally giving instructions to me on how to do all of this in the first place.
Todo:
Make Video tutorial.
Works in windows 7 as well!
For those cutting edge folkies who use windows 7, it works as well.. just follow the Vista instructions. I can also confirm that it did NOTHING to any any information on my device..
BTW.. sorry guys.. mines samsung!
many thanks for the tut & here is a perhaps simpler way for some people.
1. simply download itsutils from http://nah6.com/~itsme/itsutilsbin-20090515.zip
2. extract to empty folder and make sure your device is synced.
2b. you may have to install http://hpcmonex.net/roms/enablerapinew.cab on the device.
3. goto to the above folder with cmd - if you dont know how to use cmd then i dont need you as a tester anyway (sorry no offense meant!)
4. command: pmemdump -p 0x01ffc0ac 0x4
5. if it shows ad bc 10 55 (flash deviceid) then it's hynix flash
edit: actually the first tutorial is still very useful, if "info 8" shows something other than samsung_kby00n00hm it may still be very interesting!
if you do my steps then if it shows anything other than ec bc 42 15 (which is samsung_kby00n00hm) then please let me know.
Cmonex thank you for your short tutorial.
I edited my tutorial stating explicitly that if someone finds anything other then samsung they should reply with the info
Hi,
I'm under Seven x64, and the first how to didn't word, Qmat can't find usb port.
Cmonex's solution works well, unfortunately, I have Samsung's memory
mtech said:
Same here, Samsung.
Out of curiousity, anyone get this:
BLOCK 32 (0x20) is reversed block
BLOCK 2585 (0xA19) is bad block
Partition[0], type=0x20, start=0x2, total=0x63E
Partition[1], type=0x23, start=0x640, total=0xA80
Partition[2], type=0x25, start=0x10C0, total=0x15980
Partition[3], type=0x4, start=0x16A40, total=0x24580
about BLOCK 2585 being bad?
Click to expand...
Click to collapse
Also had that. Think it's normal.
I have a TP2 WWE and the result is:
C:\0>pmemdump -p 0x01ffc0ac 0x4
Copying C:\0\itsutils.dll to WCE:\windows\itsutils.dll
01ffc0ac: ec bc 42 15 ..B.
Click to expand...
Click to collapse
Thread stuck.
Dave
monx® said:
it seems until now everybody hv samsung chipset (including me).
what about only post here if u hv other than samsung chip? so we wont get over excited when see new post here (except this post please )
Click to expand...
Click to collapse
Agreed.
I edited my start-post/tutorial and clearly stated that people only should reply if they have anything else then samsung_kby00xxx.
Can somebody explane me why need Hynix chip ? Samsung are more secured or what ?
ps: 3 pieces of TP2, all samsung chips. I remember that week or two ago, I disassembled one tp2 with damaged screen and i think it was Hynix chip on board, if it mean anything.
borce_razor said:
Can somebody explane me why need Hynix chip ? Samsung are more secured or what ?
ps: 3 pieces of TP2, all samsung chips. I remember that week or two ago, I disassembled one tp2 with damaged screen and i think it was Hynix chip on board, if it mean anything.
Click to expand...
Click to collapse
It's probably an inventory/stock issue. Vendors may not have the same flash chips in stock to use on all manufactured devices. Or there could be different factories with different components available, so one factory could be putting in Hynix flash. This is a very common practice...
Hynix/Hyundai also produces RAM and other ICs, so this may have been what you've seen on your broken TP2.
cmonex,
is it geometry/block size or mfg partition location that is different on Hynix chips?
pen-pen said:
Hi,
I'm under Seven x64, and the first how to didn't word, Qmat can't find usb port.
Cmonex's solution works well, unfortunately, I have Samsung's memory
Click to expand...
Click to collapse
if you need help with that USB thing, feel free to PM me
mtech said:
Same here, Samsung.
Out of curiousity, anyone get this:
BLOCK 32 (0x20) is reversed block
BLOCK 2585 (0xA19) is bad block
Partition[0], type=0x20, start=0x2, total=0x63E
Partition[1], type=0x23, start=0x640, total=0xA80
Partition[2], type=0x25, start=0x10C0, total=0x15980
Partition[3], type=0x4, start=0x16A40, total=0x24580
about BLOCK 2585 being bad?
Click to expand...
Click to collapse
it's normal, most nand devices ship with at least one bad block though I have some that have no bad blocks just luck really, and it's not a problem if it has a couple of them, there is enough other blocks to replace them.
shure2 said:
samsung here too, are you sure that they have used hynix memory?
Click to expand...
Click to collapse
well, looks like for topaz there was no non-samsung chips, while hspl was in testing... I know that because no tester had any issues regarding flashing itself; but as soon as I released it they started getting hynix ones. that was nice timing.
CHfish said:
Sorry for spaming the thread (I've got samsung too) but
I've got a test device from HTC - and it says "Security Unlocked" on the top line of the bootloader - is this of any interest to you?
Does this mean I might flash any (unsigned) ROM?
Further information:
Code:
RHD100 32M SS-BC
SPL-0.78.0000
MicroP-Rhodium (LED) v9
MicroP-Rhodium (KEY) v4
TURBO HW/TURBO SW
TP MFG DATA
512,524 794,844
793,200 225,198
227,846 Calibrated
CHfish
Click to expand...
Click to collapse
neat that you have a prerelease. security unlock got nothing to do with OS flashing, sorry. but it is probably also supercid, so you can flash any HTC rom (but not cooked roms).
stepw said:
It's probably an inventory/stock issue. Vendors may not have the same flash chips in stock to use on all manufactured devices. Or there could be different factories with different components available, so one factory could be putting in Hynix flash. This is a very common practice...
Hynix/Hyundai also produces RAM and other ICs, so this may have been what you've seen on your broken TP2.
cmonex,
is it geometry/block size or mfg partition location that is different on Hynix chips?
Click to expand...
Click to collapse
a nand ctl config register is different. this configs for example where to find bad block bytes in the raw read of a nand page (btw, some of the config values are different on hynix than on samsung, but the bad block one happens to be the same on both). on topaz its contents can get "corrupt" (as I dont have such a problematic device I still don't know why), and it happens that the "corrupt" contents didn't affect much except that the SSPL could not read/write nand (it thought all blocks were bad but did not attempt to write the bad block data back); I put "corrupt" in quotes as it is always the same value, not random. anyway, I fixed that on topaz in the end but I would like to see one such device on rhodium, let's see if someone comes up with one soon. I'm pretty sure rhodium has devices with hynix too (even raphael has them, but it wasn't a problem on raphael).
PS: I think the problem with it getting "corrupt" is that topaz (and rhodium probably) handles this config register differently anyway (different from raphael etc). I mean the part is different when you send a request to nand via dm with some buffers with commands and configs in them. what I don't know is exactly how this affects the hynix devices.
cmonex said:
well, looks like for topaz there was no non-samsung chips, while hspl was in testing... I know that because no tester had any issues regarding flashing itself; but as soon as I released it they started getting hynix ones. that was nice timing.
Click to expand...
Click to collapse
Uhhh...that's bad.
Don't you think people would be clever enough to understand a warning message like "check your internal memory before flashing HardSPL!"
...uhm...no...
...forget my words...just a moronic touch of confidence in mankind
cmonex said:
a nand ctl config register is different. this configs for example where to find bad block bytes in the raw read of a nand page (btw, some of the config values are different on hynix than on samsung, but the bad block one happens to be the same on both). on topaz its contents can get "corrupt" (as I dont have such a problematic device I still don't know why), and it happens that the "corrupt" contents didn't affect much except that the SSPL could not read/write nand (it thought all blocks were bad but did not attempt to write the bad block data back); I put "corrupt" in quotes as it is always the same value, not random. anyway, I fixed that on topaz in the end but I would like to see one such device on rhodium, let's see if someone comes up with one soon. I'm pretty sure rhodium has devices with hynix too (even raphael has them, but it wasn't a problem on raphael).
PS: I think the problem with it getting "corrupt" is that topaz (and rhodium probably) handles this config register differently anyway (different from raphael etc). I mean the part is different when you send a request to nand via dm with some buffers with commands and configs in them. what I don't know is exactly how this affects the hynix devices.
Click to expand...
Click to collapse
This is odd, there's a flash driver - a geometry descriptor and a set of flash related procs in SPL for each supported NAND flash type. I don't see how SPL would work at all (e.g. flash OS and such) if Hynix driver is broken/missing. There should be no need to program NAND directly in SSPL AFAIK, the driver should be taking care of setting proper flags (block status, bad block, etc...) in out-of-band portion of NAND page.
Is there a chance SPL on devices with Hynix NAND includes a Hynix driver and SPL on devices with Samsung NAND does not? They might even be the same version, but the driver could be missing in one...
stepw said:
This is odd, there's a flash driver - a geometry descriptor and a set of flash related procs in SPL for each supported NAND flash type. I don't see how SPL would work at all (e.g. flash OS and such) if Hynix driver is broken/missing. There should be no need to program NAND directly in SSPL AFAIK, the driver should be taking care of setting proper flags (block status, bad block, etc...) in out-of-band portion of NAND page.
Is there a chance SPL on devices with Hynix NAND includes a Hynix driver and SPL on devices with Samsung NAND does not? They might even be the same version, but the driver could be missing in one...
Click to expand...
Click to collapse
OK I'll try to explain a bit better... when the topaz (and rhodium) SPL boots, its nand driver code can of course handle either chip, but it relies on this nand config register having the right value on booting SPL (normally radio bootloader sets it up for SPL). this value is what changes on hynix units when or before loading SSPL, and I don't know why. - but I intend to find out
PS: the SPL binary itself is same for both types.
Is there any chance you guys will release a Samsung-only HardSPL with a big fat warning label?

[Tool] VS920 Repair Utility

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This utility will help you recover your IMEI / MEID from a bad flash.
WARNING:
This software only allows you to write to the device if the IMEI / MEID is zero'd out or does not contain anything.
DO NOT WRITE SOMETHING YOU DON'T WANT. IF YOU WRITE THE WRONG IMEI / MEID YOU ARE SCREWED.
I do not condone changing / modifying / tampering with the serial IT IS ILLEGAL. It is however legal to recover the original one, that is what this software will allow you to do.
I will not answer PM's because you typed the wrong serial number or because you tried something you shouldn't have. This is a fair warning. Make sure you type your original serial number in correctly the first time. Both boxes must match.
[How To Use]
1.) Plug device into computer.
2.) Select Internet Connection Mode, select Modem.
3.) Open device manager to see what COM your device is on.
4.) Open software and select the COM, there is two the device will connect on, you only need to write the information to one of them.
5.) Click on Connect.
6.) Type/Paste you're MEID/IMEI, verify it before you click Repair.
7.) Verify again.
8.) Click repair, wait for software to reboot your device.
9.) If the phone doesn't reboot after 1 Min, go ahead and reboot your device.
10.) Enjoy your ICS rom on your working VS920 device.
[Problems]
Q.) What do I need in order to run the software?
A.) Just dotnet 4.0
Q.) Where do I get my IMEI/MEID ?
A.) Remove the back, then remove the battery. There is a white sticker that say's IMEI. Type the whole string in the top box ignoring the last number its a checksum, you will see the last number being calculated on the IMEI field. Make sure it all matches up.
Q.) I didn't listen/read what you wrote about the 1 time write.
A.) I can't do anything for you.
Q.) The application is throwing an error.
A.) Please take a screen shot, and copy the error then paste here.
Q.) The application just randomly quites.
A.) Stop trying to log what the application is doing, quit any debuggers and try to open the app again.
Q.) My antivirus is picking this up a a virus/torjan why?
A.) Most antivirus suck anyway, they scan on the pe header of the file. If its unable to process it, it will automatically flag the program as a virus. I assure you there is no virus. All my software gets protected low level to prevent tampering with.
Q.) Was the license agreement really needed, its annoying!
A.) No it probably wasn't but to protect me, FTT, and XDA-Developers then yes. I put that there you are fully aware that it is an as is software and you are agreeing not to reverse engineer the software as well as agreeing that you are doing this at your own risk.
Video
How it works
Now while I tested this over and over on my two test devices and they work fine. This doesn't mean that it works fine on every machine. I built the app in less then a day. I have added as many checks as I can so it wont mess anything up.
DotNet Framework 4.0 Is needed.
Download Here
VS920 MEID Repair Utility 1.0
MD5 Sum
Exe: 142882a5de3ae3204704626933522fdc
Rar: 48dd4ab56710ce901af9e2e067d11e1f
DO NOT REPOST THIS ON ANY OTHER FORUMS, DO NOT LINK TO THIS FROM OUT SIDE OF XDA. I MONITOR ALL TRAFFIC ON THIS SITE. I WILL PULL THE FILES IF I HAVE TO.
Reserved for later use if i need it.
I'm getting a 404 on that link.
Link is fixed.
I would love for some success or fail stories, some feed back as well. Hopefully all success stories , but I know that never happens lol.
If I have helped you at all please don't forget to say thanks.
The rar file tested ok with 7Z.
I tried to download dotnet 4.0 and my Win7 64 bit machine asked if I wanted to re install it.
The program crashes before it opens.
A popup askes to check the web for a fix.
EDIT:
You sure that was Internet Modem, or Ethernet?
EDIT:
Fail either way.
Same results here. Also what language was this built in?
Hmm can you post a screen shot of the crash. Ill have to check it out. I have another machine ill run it on right now.
Wow I'm an idiot
No wonder it crashed.
dotNet 4.5 ughh...
You can try to install 4.5 if you want or ill have to recompile later tonight.
Application Crash
Code:
Faulting application name: VS920 MEID Repair Utility.exe, version: 1.0.0.0, time stamp: 0x4fc6f0df
Faulting module name: KERNELBASE.dll, version: 6.1.7601.17651, time stamp: 0x4e211319
Exception code: 0xe0434352
Fault offset: 0x0000b9bc
Faulting process id: 0x2224
Faulting application start time: 0x01cd3eef4903a23f
Faulting application path: C:\Users\Blake\Desktop\VS920 MEID Repair Utility.exe
Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
Report Id: 874a351a-aae2-11e1-9249-f1c420cf0b5b
And the .Net crash
Code:
Application: VS920 MEID Repair Utility.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.TypeLoadException
Stack:
at System.ModuleHandle.ResolveMethod(System.Reflection.RuntimeModule, Int32, IntPtr*, Int32, IntPtr*, Int32)
at System.ModuleHandle.ResolveMethodHandleInternalCore(System.Reflection.RuntimeModule, Int32, IntPtr[], Int32, IntPtr[], Int32)
at System.ModuleHandle.ResolveMethodHandleInternal(System.Reflection.RuntimeModule, Int32, System.RuntimeTypeHandle[], System.RuntimeTypeHandle[])
at System.Reflection.CustomAttributeData..ctor(System.Reflection.RuntimeModule, System.Reflection.CustomAttributeRecord)
at System.Reflection.CustomAttributeData.GetCustomAttributes(System.Reflection.RuntimeModule, Int32)
at System.Reflection.CustomAttributeData.GetCustomAttributesInternal(System.Reflection.RuntimeAssembly)
at System.Reflection.RuntimeAssembly.GetCustomAttributesData()
at System.Reflection.CustomAttributeData.GetCustomAttributes(System.Reflection.Assembly)
at System.Resources.ManifestBasedResourceGroveler.GetNeutralResourcesLanguage(System.Reflection.Assembly, System.Resources.UltimateResourceFallbackLocation ByRef)
at System.Resources.ResourceManager.CommonSatelliteAssemblyInit()
at System.Resources.ResourceManager..ctor(System.Type)
at System.ComponentModel.ComponentResourceManager..ctor(System.Type)
at ?1?.?3?.?28?()
at ?1?.?3?..ctor()
at ?1?.?7?.?67?()
amoamare said:
Hmm can you post a screen shot of the crash. Ill have to check it out. I have another machine ill run it on right now.
Click to expand...
Click to collapse
I used 7z to test the archive before I tried to run it.
TypeLoadException is thrown when the common language runtime cannot find the assembly, the type within the assembly, or cannot load the type.
My visual studio decided to default 4.5 framework. So until I can recompile, might just need to install dotNet 4.5
Dotnet 4.5 Beta Download link
EEEW a beta? Just kidding.
No problem, thank you for working so hard at this...
No problem.
4.5 is actually pretty stable for being a beta. I've been running it for months now with no issues that I noticed. Then again i'm on my dev machine and it hardly has issues :S except for it doesn't like wireless keyboards and mouse's ha.
Well it looks like it would do the trick.
It ran through all the motions.
Except I haven't tried the ICS update.
I was thinkin of waiting for a .bin file instead of trying to figure out where the hell the Phone Booth could be found.
I have little doubt that this will work for those that wave gotten stuck with the peek a boo IMEI.
Now if you had the time to work out something for my poor LG Fathom.
It got a case of amnesia or something.
cac2us,
If you wan't to try the ICS update, I can team view with you and show you how to use LGNPST in order to flash the .tot. Its pretty simple once you see it the first time.
People that are having Google Play Store issues and no 4G and Intermittent 3G is because there IMEI is zero'd out. I can log into the play store fine, use my internet fine etc, but when I zero'd my IMEI and MEID out it wouldn't download my e-mails or anything, I couldn't log into the play store it would just freeze.
Whats wrong with your Fathom?
Thanks, but if the only way is to use download mode, that's what killed my fathom's MEID.
So,... aw what the hell.
If I put it in download mode then the .tot file should get accepted?
And where the hell is that Phone Booth folder that I read about?
Fahthom got flashed too many times.
And in download mode. Then I spoofed at to be an HTC 6800, and now it won't change back.
I might have to pay the $99.00 for the newer Workshop to write it back.
Maybe if I send it to you along with a bucket of cash, and the box it came in you could maybe fix it?
That Google play store issue makes sense, just like my fathom won't activate without an MEID or an IMEI.
You don't need to flash in download mode.
Connect the phone to the computer, select internet for the connect and then select modem.
Make sure you have registered the dll regsrv32 "Path to dll";
After that open LGNPST you should see that it shows the model VS920. Click on the Phone settings button, then click read. Make sure it reads everything correctly. Close out of phone settings.
The Port will flash to say its done click on it to reactive the port.
Select upgrade and click browse.
Now in the window that pops up, down at the bottom where you can select a file. Don't worry about what it says. The box above it where you can type the location enter in *.* then click enter.
This will display all files. Now select the .tot file. "You can also rename .tot to .bin" once you select the file, click on upgrade. The flash should succeed fine now..
The reason people have crashing issues is because they would go to "Phonebook" section in the software and use that. The phonebook backup/restore is not used for upgrading the phone.
Also to answer your question, yes I could most likely repair it for you. No cost, just pay for shipping here and back.
OK, I'm ready to do it.
The only part "Make sure you have registered the dll regsrv32 "Path to dll";"
Isn't that file in the Windows\System32 folder?
How do I register it. I allready did the right click thing for the 920.dll while it sits in the Models folder of LGNPST folder.
I will PM you with the details of the Fathom.. Thanks..
Yes if your using the right click register, and you right clicked and registered and it returned with succeeded then the dll is registerd and your are good to go.

Categories

Resources