Database Users

new Cingular 8125

It has 2.25 ROM code. I want to load the blackberry compatible ROM code. I have tried both unlock tools here and cant seem to get it to work. I am sure its something that I am doing wrong so could really use some help.
I have followed the steps and they say unlocked but then there is a write error. Then I get the following error when I try to just run the rom upgrade exe
"ERROR [296] : UPGRADE ONLY
I'll post again with the exact errors but in the meantime if you have any suggestions please let me know.
Thanks

http://forum.xda-developers.com/viewtopic.php?t=33796
if all else fails downgrade to a 1.x rom on the ftp server, then run lokwiz.. then after it completes successfully then you can upgrade..

What tool do I use to downgrade to the older code? each of the RUU's that I try error out saying upgrade only.

I ran the aWiz tool and get the below error:
ERROR: ITWriteDisk - An internal error occurred.
I had also installed the enablerapi.cab before running the e: enable rapi
Full cut and paste
============== aWizard 1.3 beta 2 ===============
- By ahlok_hk -
__________________________________________
- [Credits] -
- itsme for 'itsutils' -
- MachinaGod for 'RapiUnlocker' -
- MachinaGod for 'lokiwiz' -
- mamaich for 'WM5 ROM editing tool' -
- psneddon and kenu for Logo Converter -
- nicob for scripting tips -
- xda-developers.com, buzzdev.net n oths -
__________________________________________
* Please Choose one of the following options:
a - View README file
e - Enable RAPI (Run this after each hard reset)
u - Unlock CID (!!!PLEASE RUN THIS ONE TIME FIRST!!!)
b - Backup Radio, OS and Extended ROM from device
s - Write Backup Splash Logo (.nba) to Wizard
c - Convert + write BMP(240x320) Splash Logo to Wizard
r - Write Radio ROM to device (!! RUN unlock CID 1st !!)
w - Write OS ROM to device (!! RUN unlock CID 1st !!)
q - Quit this program
__________________________________________
!!! ATTENTION! Please use this tool at your own risk!!!
__________________________________________
* Type letter then press [Enter]:e
* Please FULLY (wait for a while 1st) connect your Wizard to the PC with USB Act
iveSync connection,
* then press [Enter] to start, or q to main menu:
MachinaGod RapiUnlocker v1.0
Initializing.........Done!
* Press [Enter] to continue
__________________________________________
* Please Choose one of the following options:
a - View README file
e - Enable RAPI (Run this after each hard reset)
u - Unlock CID (!!!PLEASE RUN THIS ONE TIME FIRST!!!)
b - Backup Radio, OS and Extended ROM from device
s - Write Backup Splash Logo (.nba) to Wizard
c - Convert + write BMP(240x320) Splash Logo to Wizard
r - Write Radio ROM to device (!! RUN unlock CID 1st !!)
w - Write OS ROM to device (!! RUN unlock CID 1st !!)
q - Quit this program
__________________________________________
!!! ATTENTION! Please use this tool at your own risk!!!
__________________________________________
* Type letter then press [Enter]:u
* Please connect your Wizard to the PC with USB ActiveSync connection,
* then press [Enter] to start, or q to main menu:
Initializing............CID unlocking mobile... DO NOT DISCONNECT UNTIL THE PHON
E REBOOTS!
[15:23:54.25] MachinaGod lokiwiz start
Copying C:\Temp\8125\aWizard\lib\itsutils.dll to WCE:\windows\itsutils.dll
CopyTFFSToFile(0x0, 0x10000, lock_backup.bin)
g=24: 4758a458 - 60231547f0615b52
Key idx: 24
olddata: c3ed99e06b35b4ae413277d3b404f24af3d0c04d95add7b38eeee02a7a8ffabf
newdata: fd7c6c72ecc22980ae409660572350da6e676d671dcfe5a46e676d671dcfe5a4
newsum=f3505ea9 encsum=7221e4dc8e58fd8c
This exe file was created with the evaluation version of Perl2Exe.
For more information visit http://www.indigostar.com
(The full version does not display this message with a 2 second delay.)
...
CopyFileToTFFS(cidunlocked.bin:0, 0, 00010000)
ERROR: ITWriteDisk - An internal error occurred.
result=80072746
[15:24:13.55] Your phone is now CID unlocked....
Store the generated 'lock_backup.bin' file in a safe place. It can help to resto
re your device if anything goes wrong.
* Press [Enter] to continue

wdata USB command to flash ROM

Dears,
wdata command can write data to P3300. It is possible to use this command to upgrade ROM and get around the CID lock?
If so we can make a RUU program to flash anything into ROM.
Is this pssible?

ylatsj said:
Dears,
wdata command can write data to P3300. It is possible to use this command to upgrade ROM and get around the CID lock?
If so we can make a RUU program to flash anything into ROM.
Is this pssible?
Click to expand...
Click to collapse
Of course its a good idea but I think the process is much more complicated. The update proccess depends not only on ROMUpdateUtility but also depends on the Bootloaders security. If the bootloader does not open the port for entering data, no data can be entered so no ROM update can be done. Bootloader opens the port only when the CID in the ROM file maches with the device's CID and the Signature is intact. Thats why we need USPL that does not check CID and Signature.

Tamagochi said:
Of course its a good idea but I think the process is much more complicated. The update proccess depends not only on ROMUpdateUtility but also depends on the Bootloaders security. If the bootloader does not open the port for entering data, no data can be entered so no ROM update can be done. Bootloader opens the port only when the CID in the ROM file maches with the device's CID and the Signature is intact. Thats why we need USPL that does not check CID and Signature.
Click to expand...
Click to collapse
I thought IPL won't check CID lock for wdata command. So I guess we can use wdata to flush anything into ROM (a clean,pure WM without any headers)
And we don't use ROMUpdateUtility but write an application to directly deal with the USB port on bootloder.
The purpose is to save hundreds of bricked phones. The current SuperCID program doesn't work with bootloader mode!!!
Anyone can tell me what address the Artemis OS begins with so that I can make the USB applicaiton to try to flush OS to the ROM address?

great!!
I think POF can help you
He is active in Hermes treads

ylatsj said:
I thought IPL won't check CID lock for wdata command. So I guess we can use wdata to flush anything into ROM (a clean,pure WM without any headers)
And we don't use ROMUpdateUtility but write an application to directly deal with the USB port on bootloder.
The purpose is to save hundreds of bricked phones. The current SuperCID program doesn't work with bootloader mode!!!
Anyone can tell me what address the Artemis OS begins with so that I can make the USB applicaiton to try to flush OS to the ROM address?
Click to expand...
Click to collapse
I dont think so, the SPL is like a bodyguard. To be able to write to the flashROM, some ports should be opened (enable write mode). Only the SPL can enable write mode, and it is very stubborn. Every time an application tries to write to the DOC, it asks for the CID and Signature. If these info do not match with the ones inside the DOC, it will refuse to enable write mode. You can fool it with CID but you cannot fool it with Signature unless you can imitate the signature and use it to sign the ROM file.
So the problem is how to imitate the signature or to extract it from a signed one.

Tamagochi said:
I dont think so, the SPL is like a bodyguard. To be able to write to the flashROM, some ports should be opened (enable write mode). Only the SPL can enable write mode, and it is very stubborn. Every time an application tries to write to the DOC, it asks for the CID and Signature. If these info do not match with the ones inside the DOC, it will refuse to enable write mode. You can fool it with CID but you cannot fool it with Signature unless you can imitate the signature and use it to sign the ROM file.
So the problem is how to imitate the signature or to extract it from a signed one.
Click to expand...
Click to collapse
First, sorry for q on first post and no introduction.
Basically, im male, so didn't rtfm until I got stuck...CID Locked device...botched WM6 upgrade...blah blah...bootscreen...blah...you know the score.
This thread has piqued my interest though. I am a programmer with quite a bit of experience of embedded devices. I figured that there is some way to do something like this...but not really sure how as documentation is a bit thin on the ground!
What does the wdata command actually do? My understanding is that it copies arbitary data into the devices address space...but where from? We have a dst and len, but what is the src?
wdata [Len [StartAddr]]
I assume that the flash-rom is simply mapped into linear address space.

gamefreaks said:
First, sorry for q on first post and no introduction.
Basically, im male, so didn't rtfm until I got stuck...CID Locked device...botched WM6 upgrade...blah blah...bootscreen...blah...you know the score.
This thread has piqued my interest though. I am a programmer with quite a bit of experience of embedded devices. I figured that there is some way to do something like this...but not really sure how as documentation is a bit thin on the ground!
What does the wdata command actually do? My understanding is that it copies arbitary data into the devices address space...but where from? We have a dst and len, but what is the src?
wdata [Len [StartAddr]]
I assume that the flash-rom is simply mapped into linear address space.
Click to expand...
Click to collapse
This is what I thought as well that the flash-rom is simply mapped into linear address space. But I don't know where it sits and which segment is for IPL,SPL,OS,EXTROM. etc...
And I am not sure if the IPL will secure the ROM write when it execute the "WDATA" command.
Here is the introduction for WDATA command
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
Also please check this URL
http://forum.xda-developers.com/archive/index.php/t-285112.html
Pay atttention on this
Write data to memory(if write to ROM, need erase first).
"If write to ROM" This means the ROM is for sure being mapped into the memory space. And what important is that WDATA doesn't talk to the IPL on any CID information. This possibly means that IPL won't stop a write to ROM.
So it is worth to give a try here. The information we need before make the USB application is:
1) Where does the ROM start inside the memory address space
2) Where does the OS start and end
3) How to erase the ROM before WDATA (Another USB command but what is it)
Actually, if we know where the IPL starts we could even directly flush the IPL to Pof's superCID. But this is a little dangerous becasue it is possible to crash the IPL ROM so that the Artemis even can't start bootloader. So better not do it but to flush the OS only and make the birck start first. Then use Pof's baby to flush the SuperCID.
OK, long post. Hope we can have more experts in this thread. Thank you folks for your attention on my topic.

Can't unlock CID using Lokiwiz03

Hi!
Im willing to flash my rom using a dumped OSRom.nb with pdocwrite util. The thing is that I read all the warnings about locked CID in the aWizard thread http://forum.xda-developers.com/showthread.php?t=252957&highlight=awizard
And it turned out that aWizard uses the same pdocread and pdocwrite as I do. So naturally I want to CID un-lock my hw6915.
But theres the thing I cant!
Bootscreen shows only 2 numbers
1.00.00
1.50
No SPL or IPL. I guessed that my hw6915 is G3 because of the 2 repeating zeros, but who knows. So I wanted to get into the boot loader command promt but nothing worked
action button + power + reset (all at the same time for a few seconds) is Useless.
So can someone please tell me how to determine the IPL/SPL or get into the boot loader mode or how to get my whatever G CID un-locked. The lokiwiz errors from aWizard are as follows:
Initializing............CID unlocking mobile... DO NOT DISCONNECT UNTIL THE PHON
E REBOOTS!
[ 5:50:22.76] MachinaGod lokiwiz start
CopyTFFSToFile(0x0, 0x10000, lock_backup.bin)
ERROR: ITReadDisk: outbuf==NULL
reading lock_backup.bin:
This exe file was created with the evaluation version of Perl2Exe.
For more information visit http://www.indigostar.com
(The full version does not display this message with a 2 second delay.)
...
CopyFileToTFFS(cidunlocked.bin:0, 0, 00010000)
ERROR: Unable to open host/destination file - The system cannot find the file sp
ecified.
result=80072746
[ 5:50:29.06] Your phone is now CID unlocked....
Store the generated 'lock_backup.bin' file in a safe place. It can help to resto
re your device if anything goes wrong.
* Press [Enter] to continue

rx-8 You read for what device Lokiwiz03 ??????
Where is written that this works at 6915?
Read description of the program and do not try to use on your device!

No readme file
Well actually the zip file with Lokiwiz does not contain a readme file, but I suspect that it originally was meant for Wizard but other user with different phones have reported that it had worked on their phones. So after a week of reading the forums I came up only with this cid unlocker. I guess desperation took over me... Anyways can you suggest other utility?

Please Help me To Unbrick my device

Brother i am upgrading my device it stoped at 2% now its dead only goes to bootloader show
ipl 1.81.00001
spl 1.81.00001
i master reset but nothing happened i flash all roms on wiki nothing happened always say invalid tool
i need this rom because this has previous this
Rom version 1.8.415.2 wwe
Rom date 11-3-06
Radio 02.71.90
protocol version 4.1.13.31
EXT Rom 1.8.415.102
Thanks in advance who help me in this case

I have another set of that how can i read other set rom and flash in to that set

Was it CID locked? did you buy the phone r did you get it with a subsciption?

oddball1 said:
Was it CID locked? did you buy the phone r did you get it with a subsciption?
Click to expand...
Click to collapse
Not it is Not Cid locked & Also Not Sim Locked.. yes i buy from a shop in pakistan but when i upgrade i get problem

I also have bricked my Herald after upgrading to Aserg but nothing now ,,only green screen and off ...
it was CID locked
from Mobinil Plz Help

zubi1984: i had the same problem.
try mtty.exe (use wiki), and try the commands for it.
if it says something clearly, then you can -somehow- unbrick your device.
if it gives error..
-this happedned to me-
you should bring it to the service, with warranty.
if you are lucky, they will fix it to you without price.
i hope you have warranty, because the man in the service said that i really fuc*ed it up... the new motherboard would have been very expensive.. without warranty
so first of all, calm down, and let's start reading about the upgrade, read a lot, and go to another forums, maybe somebody can help to you unbrick your device
____
my device said:
error 30* invalid upgrade tool (for any roms)
only in bootloader mode running
hard reset failed
reset does not works
no charge lights on charge
mtty.exe error, commands: no answere.
pulyka

Hi pulyka, Can you Please tell me about commands for mtty.exe..what to write inside te command box exactly ,,
any more details about "mtty " would be thankful

for me:
Cmd>info 1
Invalid command : info 1
For a help screen, use command ? or h
Cmd>info 2
Invalid command : info 2
For a help screen, use command ? or h
_____________
this is wrong.
___
read it carefully!
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader
try it, but in your own risk..
unfortunately i am not an expert in this..
some people helped me in a hungarian forum.. and they said, my pda is bricked completely:S
if mtty working properly:
sb
I already connect to USB!
Cmd>info 0
GetDeviceInfo=0x00000000
Wizard
Cmd>info 1
GetDeviceInfo=0x00000001
2.21.0000
Cmd>info 2
GetDeviceInfo=0x00000002
+ SD Controller init
- SD Controller init
+StorageInit
***** user area size = 0x1EB80000 Bytes
HTCSWIZTMO07 â-r€HTCE
Cmd>info 3
GetDeviceInfo=0x00000003
this is died device:
info1
Invalid command : info1
For a help screen, use command ? or h
Cmd>info 1
GetDeviceInfo=0x00000001
2.24.0000
Cmd>info 0
GetDeviceInfo=0x00000000
Wizard
Cmd>r2sd all
***** user area size = 0x1DE40000 Bytes
R2SDBackup() - Download type = 5
usTotalBlock = 1 sizeof(SDCARD_SIGNATRUE_TABLE)=512
GetDeviceCID: Error - InitDecoder
GetDeviceCID: Error - InitDecoder
You didn't get the proper security level to download a specific image
Cmd>
pulyka

Now what?

So, now I cant get anything working in my P4350 except the bootloader mode.
The way I got here:
Installed many roms, trying to find the best for me. After some time, even the most stable rom was not stable, all of them crashed, freezed, rebooted after about 1 day usage. (With and without SD card, and no apps installed).
So I decided to remove hardspl and do the whole thing again. I downloaded Aserg-Remove-Hard-Spl pack, and run it. After the second step the phone was not completly blank, I saw the console staying at the "praying ..." text (without backlight), and the phone didnt responded for any buttons or touch. So here came the third step, the RUU, but it gave me error 260, that it cant find my device. (How would this, since the activesync was not connected?)
So i couldnt do anything, I soft reseted the phone, but it wont turned on, or it did but the screen left blank. - like no rom were installed. I tried to press the camera, and the RGB screen came up, saying IPL 4.14.0001 and SPL 4.70 Yang.
Tried to hard reset, but when I pressed send, it said fail.
Tried to update at this position with RUU, but its need activesync so it gave me the same error. Tried to install 3 different roms from 2 differenct SD Cards (that worked before), and It checks the Card, the the RGB screen comes up (like no rom would be on the SD card).
Created a GoldCard, and installed the official ROM. The "Checking SD Card" text stays here for 5 secs, then the RGB screen comes up.. wtf?
Same with heradiag.nbh
Now tried again the Hard reset, it said succesfull, but when it tries to boot I just get a green to black gardient image, something like this: http://www.cylekx.net/help/tutorial_assets/images/byte ramp and green gradient.jpg (but rotated), and nothing else happens.
Any ideas to get the device back to life?
Maybe there are some hardware malfunction inside the phone?
Thanks, and sorry if I posted this to a wrong thread. (was not sure where it should go)
Just got a WhiteScreen crash at the "Checking SD Contents" screen.. It cant be software problem i guess.
Cmd>getdevinfo
GetDeviceCID: Error - InitDecoder
HTCSHTCE
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
==CreateFile err==nb0 Sync bytes error(0) 6B != 42
Error : DownloadImage return error (code = 0xFFFFFFFF)

While your phone is in Bootloader mode, install the original ROM with the RUU. All Heralds (P4350) and Atlas'(Wing P4351) can be flashed while on the bootloader screen. Just disregard the step on the RUU that says to make sure your phone is connected to ActiveSync. Also if you have downloaded the whole RUU for the Original ROM, you have to edit the .EXE file to remove the .SPL file that is inside. You can use 7-Zip to get inside of the .EXE file. If not, then just install the ROM as you normally would. You will not need a SD card to install this. Let us know what happens. EVERYONE: if I have forgotten to mention something, please add.

baronmxc said:
While your phone is in Bootloader mode, install the original ROM with the RUU. All Heralds (P4350) and Atlas'(Wing P4351) can be flashed while on the bootloader screen. Just disregard the step on the RUU that says to make sure your phone is connected to ActiveSync. Also if you have downloaded the whole RUU for the Original ROM, you have to edit the .EXE file to remove the .SPL file that is inside. You can use 7-Zip to get inside of the .EXE file. If not, then just install the ROM as you normally would. You will not need a SD card to install this. Let us know what happens. EVERYONE: if I have forgotten to mention something, please add.
Click to expand...
Click to collapse
Hah, i was so unlucky A chip on the motherboard burnt, so if u plugged in the USB it crashed immadiatelly, no wonder why the PC couldnt recognise it..
But still have a problem. Tried to flash the original shipped rom, and another costum rom but both said INVALID MODEL ID.
So what now?
thanks
Cmd>getdevinfo
GetDeviceCID: Error - InitDecoder
HTCSHTCE
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
==CreateFile err==nb0 Sync bytes error(0) 6B != 42
Error : DownloadImage return error (code = 0xFFFFFFFF)
Cmd>set 32
+ SD Controller init
- SD Controller init
+StorageInit
SDInit+++
PL_SDSetSlotNumber() - MPUIO_SDIF_SEL1=0, MPUIO_SD_IF_SEL=0
SDInit - SD ver2.00
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd55 Card status error in response. MMC_STAT = 4000
SD Ver2.00: Low Capacity
SD clock to 24MHz
***** user area size = 0x79A00000 Bytes
SDInit---
SDInit OK
Unlimited time!
GetDeviceCID: Error - InitDecoder
g_cKeyCardSecurityLevel = 0
HTCE
More Info:
Now i can connect with MTTY and write commands in the bootloader. With this SPL version most commands i found doesnt work, but I got some information about my phones status: the GoldCard's security level is 0, thats correct. The problem is with the CID: GetDeviceCID: Error - InitDecode
I think the problem is this, since it cant get the CID, cant verify the rom matches .
I can write things with mtty into ram or storage, is it possible to write the whole rom directly to the devices boot dir?

CheeseDave said:
Hah, i was so unlucky A chip on the motherboard burnt, so if u plugged in the USB it crashed immadiatelly, no wonder why the PC couldnt recognise it..
But still have a problem. Tried to flash the original shipped rom, and another costum rom but both said INVALID MODEL ID.
So what now?
thanks
More Info:
Now i can connect with MTTY and write commands in the bootloader. With this SPL version most commands i found doesnt work, but I got some information about my phones status: the GoldCard's security level is 0, thats correct. The problem is with the CID: GetDeviceCID: Error - InitDecode
I think the problem is this, since it cant get the CID, cant verify the rom matches .
I can write things with mtty into ram or storage, is it possible to write the whole rom directly to the devices boot dir?
Click to expand...
Click to collapse
a INVALID MODEL ID error occurs when you use the wrong RUU/ROM for a phone. Heralds must use the Herald RUU and Wings must use the Wing RUU.
Herald RUU (P4350) <- English version is the 3rd link.
T-Mobile Wing [Atlas](P4351) RUU <- Phone Number and IMEI Required
T-Mobile Wing [Atlas](P4351) RUU<- Phone Number and IMEI NOT Required however I believe that this is an older Windows 6.0 Build
If you want to keep your phone hard spl'd, you need to modify the EXE of the RUU and erase the SPL.nbh file.
As far as writing the ROM directly, that is out of my expertise. Someone else will have to answer that.

baronmxc said:
a INVALID MODEL ID error occurs when you use the wrong RUU/ROM for a phone. Heralds must use the Herald RUU and Wings must use the Wing RUU.
Herald RUU (P4350) <- English version is the 3rd link.
T-Mobile Wing [Atlas](P4351) RUU <- Phone Number and IMEI Required
T-Mobile Wing [Atlas](P4351) RUU<- Phone Number and IMEI NOT Required however I believe that this is an older Windows 6.0 Build
If you want to keep your phone hard spl'd, you need to modify the EXE of the RUU and erase the SPL.nbh file.
As far as writing the ROM directly, that is out of my expertise. Someone else will have to answer that.
Click to expand...
Click to collapse
Thanks for your help, but as i said my device ID is messed up with the USPL process... "GetDeviceCID: Error - InitDecoder" None of the RUUs works.
Waiting for the directly-writing method, or i'll have to replace the storage at the mainboard... (wont be cheap).