Related
GENE J-TAG 100% WORKING FOR DEAD HTC GENE,
ALSO KNOWN AS HTC P4300/3400i
USE THIS METHOD YOUR OWN RISK
I Successfully Restore My Gene With This Method, Then I Decide To Make This Guide For Those People Who Are Paying For J-TAG.
1. Using this instruction at a certain curvature of the hand you risk permanently kill your machine at the hardware level.
2. If you are unsure of their skills, give the unit for repair technician.
3. All claims for the consequences of using this algorithm are sent to the basket without consideration!!
The technique is based on the recovery Wizard'a loaded through the JTAG bootloader executable code into RAM and transfer control to it.
As a result, you get a temporary working bootloader, and from it produces a complete firmware device (bootloader + system )
Requirement For Do This:-
1. 5 resistors of 100 ohm ¼ value (color code can be change but value has same)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2. 25-pin LPT Port (old printer cable)
3. Wires for JTAG interface MUST not be longer 20 - 25 cm.
4. A soldering Iron Skill
5. Software H-JTAG included in gene_jtag_restore.zip file.
6. Software NoIce included in gene_jtag_restore.zip file.
7. spl.nb – bin file with patched bootloader for OLD/NEW GENE in gene_jtag_restore.zip file.
8. ruu_signed.nbh – OLD/NEW Gene base ROM with IPL and patched SPL in gene_jtag_restore.zip.
9. Download The gene_jtag_restore.zip file For Later Use.
Prepare Your Phone:
First of all To dissasemble Your device look at this site
http://www.pdacenter.ru/razborka/razbor_htc_3400_gene/
Or Some Screen shot hare..
You see these TDI,TDO,TCK,TMS,nTST Pins on board called JTAG Pin reside on your phone green litghts.
Now Solder The Wire On Borad With Very Carefully.. Otherwise it Damage Your Hardware
Prepare Your LPT Cable:
Use the diagram for Creating LPT (Parallel Port) Cable For JTAG.
You Need a port on the computer called LPT Port, in its absence (for example on some laptops) may be used PCMCI LPT.
It Look Like This....
Done,, Now Connect Your Gene With This LPT Port Or You Can Say JTAG Cable
Twist the wire each other perfectly and use the tape for cover the joints...
Done...
Prepare H-JTAG Software:
1. Install And In H-JTAG.
2. Do Some Setting Like Like This...
1) In tap configuration should be this.
2) In Target Manager setting should be this.
3) In LPT JTAG Setting should be this, and nTRST checkbox must be clear. And User Define Pin Assignment Should Same As Like in The Picture.
Test H-JTAG Software is Connecting With Your Device:
Before Going Next You Must Have Full Charge Battery Of The Your Gene..
Now Put it in Your Gene And Go Next Step..
1. Set the H-JTAG.
2. We Press buttons and hold Power and Camera for 5 seconds. If the device is enabled through the power supply is activated.
3. In H-JTAG press Detect Target. Our processor with ID 0x0692602F Should be defined.
Are You Looking This..
Done. Your Half Part Is Completed...
Now Setup NoIce Software:
1. Install NoIce Software on Your PC.
2. Open NoIce Software and Setup NoIce With H-JTAG Software (Means Connect Both Software Each Other Will use Late).
3. Choose Options-Target Communications.
4. Select the RDI Interface.
5. Indicates where the H-JTAG.dll for RDI.
6. Put frequency of the processor (specify 200).
See The Picture And Do The Above Mention Steps..
7. Then click OK and close the program NoICe.
8. Done...
Now Play The Game...
1. Prepare Dead device for Restore.
2. Connect LPT JTAG Cable to LPT Port of Your PC. (Or Already Connected)
3. Start the H-jtag (the settings for the processor are given above).
4. Turn device - we press and hold the Camera button and POWER.
5. In H-jtag perform Detect Target Device - you should decide on the processor with the correct ID (0x0692602F).
You See This..
6. Run NoICe if everything is normal and all right-minded above program should be the address of 0000 and you see the code ARM.
7. If you have NEW GENE create a folder NEWGENE in c:\ (root) without any space example C:\NEWGENE . And copy spl.nb & ruu_signed.nbh file from (for new Gene (SN - HT8x)) folder which include in gene_jtag_restore.zip to in this NEWGENE Folder and also copy the full RomUpdateUtility in this folder.
OR
8. If you have OLD GENE create a folder OLDGENE in c:\ (root) without any space exmpale C:\OLDGENE . And copy spl.nb & ruu_signed.nbh file from (for new Gene (SN - HT7x)) folder which include in gene_jtag_restore.zip to in this OLDGENE Folder and also copy the full RomUpdateUtility in this folder.
Next, consider the following illustration, And Use The Step Below The Picture..
1. Necessarily ..first we put a tick on Load as binary image.
2. We Specify the address of loading in RAM 10000000 (Check it Correctly).
3. We Choose a file bootloader for loading spl.nb form Folder.
4. Choose This File Form,, If Your Gene is New Use NEWGENE Folder.
Or
5. Choose This File Form,, If Your Gene is OLD Use OLDGENE Folder.
6. We press Ok and we see progress a bar of loading (it is necessary to wait some time).
7. As soon as its filled with the file we choose item of menu View and choose submenu Disassemble at...
8. Address necessary to be specified 10000000,
9. We press Ok and we see code ARM - if aall ij well and the file is loaded , then the first command should be EA0003FE.
6. Press And Hold Camera Button and Press on the program menu RUN and to submenu Go FROM...
7. We Specify 10000000 in address and press Ok....
8. Device must be run in mode bootloader.
9. If Your Device Boot In Bootloader Mode So, Now Camera And Power Button can be released..
Now Flash The Device With Boot Rom
1. Now We connect to usb and it is flashed with ruu_signed.nbh file from Folder OLDGENE/NEWGENE depend on Your Gene Model..
2. It is possible remove Jtag and to collect Your phone.
3. Further we flash with a good ROM(cooked) and no stock ROM please.. it’ll kill it again...
DOWNLOAD : - gene_jtag_restore.zip
Good Bye.....
Thats a Step-By-Step Guide on JTAG for New bees
Hi Guru,
You have done an awesome compilation. You have really made a step-by-step guide for JTAG for the new bees. I like to thank you for your valuable work. And also like to thank the members of XDA-Developers -
Orefkov, BesFen, Krazy_about_technology, Addicted2xda, Vaibhav_batra_the_techguy, haree, karan999, sumeet922, gurusinghbrar and so on...
for their valuable work on HTC Gene - JTAG Recovery & ROM Development.
Last but not the least... Keep it up, Guru. I give you Lots of Applause for this Post.
Moderators can you make this post Sticky... Its a request, Please.Thanks to XDA-Developers for giving such a team support.
Awesome !!!!!!!!!!!!!!!! great work.thanks for sharing.
thanks for sharing
Help us to start dead p3400i
please tell me location of Bootloader file, you have mentioned (sspl-s_wizard.nb) in bitmap.. i am unable to find bootloader.. for loading.
Thanx for solution........but accidentally my Phone's TDI pin has Damaged..........pls tell me any solution of tracing or clone of the TDI pin.
Help please!!!!
I have bricked my HTC Gene While flashing it with a official rom
I went through your Step by step instruction for unbricking with J TAG
but the main problem i use a netbook and it does not have the port for printer
i have even sent the phone for service and it was useless
this phone is very dear to me and cant see it just lying . please suggest a alternative method im also willing to send the phone to you if you will help me unbrick it
gurusinghbrar said:
GENE J-TAG 100% WORKING FOR DEAD HTC GENE,
ALSO KNOWN AS HTC P4300/3400i
USE THIS METHOD YOUR OWN RISK
I Successfully Restore My Gene With This Method, Then I Decide To Make This Guide For Those People Who Are Paying For J-TAG.
1. Using this instruction at a certain curvature of the hand you risk permanently kill your machine at the hardware level.
2. If you are unsure of their skills, give the unit for repair technician.
3. All claims for the consequences of using this algorithm are sent to the basket without consideration!!
The technique is based on the recovery Wizard'a loaded through the JTAG bootloader executable code into RAM and transfer control to it.
As a result, you get a temporary working bootloader, and from it produces a complete firmware device (bootloader + system )
Requirement For Do This:-
1. 5 resistors of 100 ohm ¼ value (color code can be change but value has same)
2. 25-pin LPT Port (old printer cable)
3. Wires for JTAG interface MUST not be longer 20 - 25 cm.
4. A soldering Iron Skill
5. Software H-JTAG included in gene_jtag_restore.zip file.
6. Software NoIce included in gene_jtag_restore.zip file.
7. spl.nb – bin file with patched bootloader for OLD/NEW GENE in gene_jtag_restore.zip file.
8. ruu_signed.nbh – OLD/NEW Gene base ROM with IPL and patched SPL in gene_jtag_restore.zip.
9. Download The gene_jtag_restore.zip file For Later Use.
Prepare Your Phone:
First of all To dissasemble Your device look at this site
http://www.pdacenter.ru/razborka/razbor_htc_3400_gene/
Or Some Screen shot hare..
You see these TDI,TDO,TCK,TMS,nTST Pins on board called JTAG Pin reside on your phone green litghts.
Now Solder The Wire On Borad With Very Carefully.. Otherwise it Damage Your Hardware
Prepare Your LPT Cable:
Use the diagram for Creating LPT (Parallel Port) Cable For JTAG.
You Need a port on the computer called LPT Port, in its absence (for example on some laptops) may be used PCMCI LPT.
It Look Like This....
Done,, Now Connect Your Gene With This LPT Port Or You Can Say JTAG Cable
Twist the wire each other perfectly and use the tape for cover the joints...
Done...
Prepare H-JTAG Software:
1. Install And In H-JTAG.
2. Do Some Setting Like Like This...
1) In tap configuration should be this.
2) In Target Manager setting should be this.
3) In LPT JTAG Setting should be this, and nTRST checkbox must be clear. And User Define Pin Assignment Should Same As Like in The Picture.
Test H-JTAG Software is Connecting With Your Device:
Before Going Next You Must Have Full Charge Battery Of The Your Gene..
Now Put it in Your Gene And Go Next Step..
1. Set the H-JTAG.
2. We Press buttons and hold Power and Camera for 5 seconds. If the device is enabled through the power supply is activated.
3. In H-JTAG press Detect Target. Our processor with ID 0x0692602F Should be defined.
Are You Looking This..
Done. Your Half Part Is Completed...
Now Setup NoIce Software:
1. Install NoIce Software on Your PC.
2. Open NoIce Software and Setup NoIce With H-JTAG Software (Means Connect Both Software Each Other Will use Late).
3. Choose Options-Target Communications.
4. Select the RDI Interface.
5. Indicates where the H-JTAG.dll for RDI.
6. Put frequency of the processor (specify 200).
See The Picture And Do The Above Mention Steps..
7. Then click OK and close the program NoICe.
8. Done...
Now Play The Game...
1. Prepare Dead device for Restore.
2. Connect LPT JTAG Cable to LPT Port of Your PC. (Or Already Connected)
3. Start the H-jtag (the settings for the processor are given above).
4. Turn device - we press and hold the Camera button and POWER.
5. In H-jtag perform Detect Target Device - you should decide on the processor with the correct ID (0x0692602F).
You See This..
6. Run NoICe if everything is normal and all right-minded above program should be the address of 0000 and you see the code ARM.
7. If you have NEW GENE create a folder NEWGENE in c:\ (root) without any space example C:\NEWGENE . And copy spl.nb & ruu_signed.nbh file from (for new Gene (SN - HT8x)) folder which include in gene_jtag_restore.zip to in this NEWGENE Folder and also copy the full RomUpdateUtility in this folder.
OR
8. If you have OLD GENE create a folder OLDGENE in c:\ (root) without any space exmpale C:\OLDGENE . And copy spl.nb & ruu_signed.nbh file from (for new Gene (SN - HT7x)) folder which include in gene_jtag_restore.zip to in this OLDGENE Folder and also copy the full RomUpdateUtility in this folder.
Next, consider the following illustration, And Use The Step Below The Picture..
1. Necessarily ..first we put a tick on Load as binary image.
2. We Specify the address of loading in RAM 10000000 (Check it Correctly).
3. We Choose a file bootloader for loading spl.nb form Folder.
4. Choose This File Form,, If Your Gene is New Use NEWGENE Folder.
Or
5. Choose This File Form,, If Your Gene is OLD Use OLDGENE Folder.
6. We press Ok and we see progress a bar of loading (it is necessary to wait some time).
7. As soon as its filled with the file we choose item of menu View and choose submenu Disassemble at...
8. Address necessary to be specified 10000000,
9. We press Ok and we see code ARM - if aall ij well and the file is loaded , then the first command should be EA0003FE.
6. Press And Hold Camera Button and Press on the program menu RUN and to submenu Go FROM...
7. We Specify 10000000 in address and press Ok....
8. Device must be run in mode bootloader.
9. If Your Device Boot In Bootloader Mode So, Now Camera And Power Button can be released..
Now Flash The Device With Boot Rom
1. Now We connect to usb and it is flashed with ruu_signed.nbh file from Folder OLDGENE/NEWGENE depend on Your Gene Model..
2. It is possible remove Jtag and to collect Your phone.
3. Further we flash with a good ROM(cooked) and no stock ROM please.. it’ll kill it again...
DOWNLOAD : - gene_jtag_restore.zip
Good Bye.....
Click to expand...
Click to collapse
dude m bit confused in connection of wire in lpt port the diagram image here in this page is different n the diagram image is different in the gene_Jtag_restore.rar ,so plz help me which connect i should do for my restore process,reply.
thank in advance
Haha
lol nobody gives a fukc
Btw is it like something usb jigg !
THANKS
Thanks this will help me with my dads old phone.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
[Do NOT Download yet Due to BUGS!]
OEM Changer changes the OEM of the Windows Phone Store with the click of a button. You don't need to configure fiddler settings or create a proxy server. Using the proven exploit in the Windows Phone Store using a proxy server and fiddler, This application automates the process with one click of the mouse.
OEM Changer is installed using an extremely simple process that will be explained in the instructions below.
BEFORE INSTALLING:
Make sure Fiddler for .NET 2 or .NET 4 is installed. The application itself works on .NET 2 or later.
INSTALLING THIS APPLICATION:
First, you need to download the application. It can be downloaded from the below "Attachments" section.
Next, extract the .ZIP file and save the extracted file where you woild like. It can be in Program Files, Desktop, Documents, etc.
Open the .EXE contained in the file. Do not touch the config file, it will break the application.
Once the EXE is open, you have installed and ran the application. Enjoy.
Once you open the application, if you are running Version 1.7 (Latest), the application will look like this:
To begin using it, put the phone manufacturer your phone is made by in the first box. In the second box, put the OEM you would like to use. Then, click "Make Changes".
Once you change your OEM, a window will appear with a proxy and instructions. This is the proxy you will use. The window looks like this:
Next, go onto your phone and open the settings. Go into Wifi and select your primary WiFi Network until you see a screen like this:
Now, put the information shown on your computer (The IP and Port) into the IP and Port boxes on your phone. Save the proxy, close the Windows Store, and reopen the store and begin downloading apps created by other OEMs.
THINGS TO NOTE ABOUT DOWNLOADING THESE APPS:
Some of them may not support the resolution of your device's screen.
UPDATE CHANGELOG:
1.0 - IR (Initial Release)
1.5 - Fixed bug preventing the opening of the application. Added proxy support.
1.6 - Added Huawei support. Added Huawei Libraries.
1.6.5 - Replaced outdated and non-optimized code. Replaced the duplicate-copy method used to put the libraries and the macro files in their correct places. Non-duplicating cuts file size in half.
1.7 - Major Update removing the application's dependency on macros. Now, the application uses a more standard and, overall, better technique to do the same thing as done in previous versions. Also, I have reduced the file size by 4.2 MB. In addition, the UI has been remodeled to work more fluidly and is now much easier to use. Also attempted to fix IP bugs. May not work on some computers. Also, Fiddler now opens automatically and closes automatically. No work for you to do this. Now works on .NET Framework 2.0!
1.7.5 - Hotfixes, Automatic Startup Config, Progress made on IP Bug.
Works great now!!! Thank you!!!
tonbonz said:
Works great now!!! Thank you!!!
Click to expand...
Click to collapse
NP. Also note I have just updated the file with some bugfixes if you are encountering any bugs.
has someone managed to download nokia apps on ATIV S after doing this?
is there a risk for using this program?:victory:
shayx said:
has someone managed to download nokia apps on ATIV S after doing this?
is there a risk for using this program?:victory:
Click to expand...
Click to collapse
There are no risks as it is running off of your personal computer and does not connect to any servers, or really anything that could install a virus/malware to your computer. On the phone side, there are also no risks. The application spoofs the OEM-Specific applications to install like any other windows phone application. The risk is essentially the same as installing any other windows phone application.
To awnser your second question, the program will install on a ATIV S. Just set the first box to Samsung and the second to Nokia.
iPwnza said:
There are no risks as it is running off of your personal computer and does not connect to any servers, or really anything that could install a virus/malware to your computer. On the phone side, there are also no risks. The application spoofs the OEM-Specific applications to install like any other windows phone application. The risk is essentially the same as installing any other windows phone application.
To awnser your second question, the program will install on a ATIV S. Just set the first box to Samsung and the second to Nokia.
Click to expand...
Click to collapse
thank you! will try it out. sounds great.
Getting this error when starting Fiddler:
[/URL]
Uploaded with ImageShack.us[/IMG]
cevi said:
Getting this error when starting Fiddler:
[/URL]
Uploaded with ImageShack.us[/IMG]
Click to expand...
Click to collapse
Have you added any rules before installing this program? If so:
Uninstall and reinstall fiddler.
Restart fiddler, make sure it works.
Open my application and click "Clear changes". Click OK to any errors, warnings, or info boxes.
Now run the OEM changer normally and see if it works now.
Ok i`ve reinstalled Fiddler now and i`ve managed to bypass this error. Probably because first i installed Fiddler for Net.2 and then over that same installation i`ve installed the Net.4 version.(Not sure about this).Now when i put the proxy in the advanced wifi settings i get no network even it says connected.Tell me this.Do i have to first open the 8888 port in the Firewall because i`ve turn it of the both with the antivirus and still not managed to get connected.
cevi said:
Ok i`ve reinstalled Fiddler now and i`ve managed to bypass this error. Probably because first i installed Fiddler for Net.2 and then over that same installation i`ve installed the Net.4 version.(Not sure about this).Now when i put the proxy in the advanced wifi settings i get no network even it says connected.Tell me this.Do i have to first open the 8888 port in the Firewall because i`ve turn it of the both with the antivirus and still not managed to get connected.
Click to expand...
Click to collapse
I'll do some testing and see if it works with only .NET 4. Also, for your other issue. This is a known issue and is easy to fix:
If you have multiple devices or software connected that create an IP (Connected printers, the Windows Phone Emulator for example), my app will detect that IP as the one you are using. To fix, open command prompt and type "IPCONFIG". Scroll up to the top, until you see the text "Windows IP Configuration". Now look for the names of all of the network adapters. Try each one you see until you find the one that works. To try one, under that adapter name, look for "IPV4 Address". Put that into your phone.
iPwnza said:
I'll do some testing and see if it works with only .NET 4. Also, for your other issue. This is a known issue and is easy to fix:
If you have multiple devices or software connected that create an IP (Connected printers, the Windows Phone Emulator for example), my app will detect that IP as the one you are using. To fix, open command prompt and type "IPCONFIG". Scroll up to the top, until you see the text "Windows IP Configuration". Now look for the names of all of the network adapters. Try each one you see until you find the one that works. To try one, under that adapter name, look for "IPV4 Address". Put that into your phone.
Click to expand...
Click to collapse
That`s exactly the same ip address that shows up in the ipv4 address on my wifi card (which is active) when i open cmd.Tell me about the port "8888".When i check it using Open Port Checker, it`s not opened.
Nice job!
cevi said:
That`s exactly the same ip address that shows up in the ipv4 address on my wifi card (which is active) when i open cmd.Tell me about the port "8888".When i check it using Open Port Checker, it`s not opened.
Click to expand...
Click to collapse
Ok. Port 8888 is the default port used by Fiddler. First, go into fiddler and go into Tools > Fiddler Options. Open the connections tab and make sure fiddler says "Listening to port 8888". If not, put 8888 in the box. Next, look for the "Allow remote connections to connect" checkbox and make sure it is checked. Fiddler should automatically open the port for you if these settings are selected, but if not, just port forward port 8888, make sure it is open, and try again.
Ok.The problem was that the macro at the end when it saves the text file, it closes Fiddler too.I did not noticed that in the beginning.Now works fine.
Thanks.
Sent from my Windows Phone 8S by HTC using Board Express
Click Change OEM and getting this Error:
"The specified executable is not a valid application for this OS platform."
And when I click Open Fiddler, getting this:
"The system cannnot find the file specified."
I install Fiddler and it run normally.
otakus007 said:
Click Change OEM and getting this Error:
"The specified executable is not a valid application for this OS platform."
And when I click Open Fiddler, getting this:
"The system cannnot find the file specified."
I install Fiddler and it run normally.
Click to expand...
Click to collapse
That's an error with Windows itself, not my app. What version of Windows are you running? If it's Windows XP or earlier, this application will not work. I'm working on an update today with numerous new features, wait until then and see if it works (If you are not running XP)
iPwnza said:
That's an error with Windows itself, not my app. What version of Windows are you running? If it's Windows XP or earlier, this application will not work. I'm working on an update today with numerous new features, wait until then and see if it works (If you are not running XP)
Click to expand...
Click to collapse
Hello,
thanks for the app. On german Win 7 x64 i always get an error after the dialog "configuration required". The app doesn´t create a config file.
Error:
Microsoft .NET Framework:
The system can not find the specified file.
Has somebody a solution for me? Fiddler runs without an error. I don´t know, which file is missing. Tested on 2 computers.
H3ng5t said:
Hello,
thanks for the app. On german Win 7 x64 i always get an error after the dialog "configuration required". The app doesn´t create a config file.
Error:
Microsoft .NET Framework:
The system can not find the specified file.
Has somebody a solution for me? Fiddler runs without an error. I don´t know, which file is missing. Tested on 2 computers.
Click to expand...
Click to collapse
Is this error message appearing after you apply an OEM Change? If not, just ignore the error and continue using the app.
I can't get that to work either. I am running Windows 8.1 x64 (German) which has .Net 4.0 already installed. I installed fiddler for .Net 4 but when I run the OEM Changer i get an error "The System can't locate the specified file". If I click "continue" the app starts and I can select current OEM and new OEM and when I click "make changes" I can see the fiddler splash screen for a split seccond. However, when I enter the proxy into my phone the phone shows the wifi as "connected" but I can not access anything online.
EDIT: Nevermind, I had to check the "Allow remote connections to connect" checkbox in fiddler. Now my phone can access the marketplace but the "Nokia Collection" section is emtpy now. I tried changing to HTC and Samsung Marketplaces.
iPwnza said:
Is this error message appearing after you apply an OEM Change? If not, just ignore the error and continue using the app.
Click to expand...
Click to collapse
The error message still comes on every startup. I always see messagebox hxxp://up.picr.de/15689246rn.png and after that the error message.
Localhorst86 said:
I can't get that to work either. I am running Windows 8.1 x64 (German) which has .Net 4.0 already installed. I installed fiddler for .Net 4 but when I run the OEM Changer i get an error "The System can't locate the specified file". If I click "continue" the app starts and I can select current OEM and new OEM and when I click "make changes" I can see the fiddler splash screen for a split seccond. However, when I enter the proxy into my phone the phone shows the wifi as "connected" but I can not access anything online.
EDIT: Nevermind, I had to check the "Allow remote connections to connect" checkbox in fiddler. Now my phone can access the marketplace but the "Nokia Collection" section is emtpy now. I tried changing to HTC and Samsung Marketplaces.
Click to expand...
Click to collapse
Same Problem here. Now i checked also "Allow remote connections to connect" checkbox in fiddler and then i can connect to marketplace. But i still have the samsung section only.
During the last weeks I was researching how to build a cable to establish an UART connection to my I9300. This guide should work but is still work in progress. Feel free to contribute.
Info: this is a guide for the international version I9300 with XMM6260 modem. The SGH-I747-variant uses a different baseband/modem from Qualcomm.
Warning: This guide allows you to interface your device at a very low level. You might brick your device or damage vital parts of it. A lot of this stuff is undocumented and there might be side effects. Be warned!
Short technical explanation:
By using a custom build USB cable you can establish a serial connection to your phone. It offers a UART interface to the XMM6260/X-Gold 626 modem used in the I9300.
The longer technical explanation:
The I9300 uses a FSA9485 USB Port Multimedia Switch (https://www.fairchildsemi.com/products/analog-mixed-signal/switches/accessory-switches/FSA9485.html) behind the MicroUSB port. This IC can detect what kind of accessories are plugged to your USB port. The detection is done by a resistor wired between GND and ID pin of the USB cable. Using a resistance level of 523K will trigger the UART Mode. While in UART mode the I9300 will use the D- and D+ pins of the MicroB-plug as serial TX/RX data lines.
What to to with it?
While booting you can see debugging output of the secondary bootloader (not that much though, mainly eMMC initialize). Once booted you can see modem output and send commands to it. Another option is to show "PDA" messages, but i never managed to get any output with this setting.
You can communicate to your modem using AT-commands. For more information I recommend reading E:V:A's great post "[XMM6260][X-GOLD 626] Modem Specification / Documentation / Hack-Pack". While his guide is focussing on the SGS2, i want to keep this guide I9300 specific.
How to build a cable?
Stuff you need:
A USB to serial converter supporting 3,3V(!) TTL levels (lots of this stuff around, check eBay or your local electronics supplier. Common chipsets are FTDIs FT232RL or Silicon Labs CP21xx, just make sure it supports 3,3V!)
A USB MicroB plug (like this https://www.sparkfun.com/products/10031 or I just sacrificed a cable for soldering directly to the connector which works too)
a resistor with 523K resistance (close value will work)
some wires
a soldering iron
Wire it like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
How to use it (tested with I9300XXELL4 (Android 4.1.2):
Install the drivers for your USB to serial converter (running linux your device will most likely be autodetected and assigned to /dev/ttyUSB0 or similar)
On your I9300 Dial *#7284# and set UART mode to "modem"
use your favorite serial console and set the following parameters for the serial port: rate: 115200 baud, data: 8 bits, parity: none, stop bit: 1, software flow-control: enable
I prefer using the "screen"-command on linux: "screen -t 'ttyUSB0 115200 8n1' /dev/ttyUSB0 115200,-ixoff,-ixon"
Now connect your UART-cable to the phone (it will power up on its own due to the FSA9485 chip, no need to worry)
If you see console output like this you got it right:
Code:
PMIC rev = PASS2(2)
BUCK1OUT(vdd_mif) = 0x05
BUCK3DVS1(vdd_int) = 0x20
[MMC] there are pending interrupts 0x00010000
cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000311
mmc->host_caps: 0x00000311
mmc_initialize: mmc->capacity = 30777344
�
AST_POWERON
AST_POWERON
AST_POWERON
Now you should be ready to send AT-commands to your phone.
Try send a simple "AT" and your phone should respond with "OK"
Code:
AT
OK
If everything above works you successfully managed to establish a serial console to your baseband processor. congratulations! proceed to the next post for tested AT commands.
Another warning at this time: Do not send random characters/commands to your modem. This is an easy way to brick your network connection or even your entire phone.
Troubleshooting:
check the wiring, maybe you switched TX/RX data lines
on linux check user rights on your /dev/ttyUSBX device, check with superuser if unsure
to be extended
THX to:
E:V:A for his great guides about modems/AT commands in general and the XMM6260
the Replicant project: http://www.replicant.us/
many other guys gave me a hint in the right direction which I forgot to mention here
Supported AT commands on the I9300
Please take this warning serious! As this is a debugging console to your baseband/modem the wrong command can easily overwrite vital data on you phone. Think before typing!
I won't go into detail about AT command syntax here. I recommend to read the following infos before trying any own approaches:
http://en.wikipedia.org/wiki/Hayes_command_set
http://www.codeproject.com/Articles/85636/Introduction-to-AT-commands-and-its-uses
http://forum.xda-developers.com/showthread.php?p=53175152#post53175152
AT commands are modem specific. Not all commands work on all modems, but there are still some general commands working on most phones!
Working AT commands:
AT+CLAC --> gives a list of all supported AT commands, though there are more commands which are undocumented, following output on I9300:
Code:
ATS
ATD
ATA
ATO
ATE
ATH
ATV
ATZ
ATl
ATm
ATQ
ATX
AT&F
AT&D
AT&C
AT\Q
AT+CGSMS
AT+CMGD
AT+CMGF
AT+CMGL
AT+CMGR
AT+CMGS
AT+CMGW
AT+CMMS
AT+CMSS
AT+CNMA
AT+CNMI
AT+CPMS
AT+CSCA
AT+CSCB
AT+CSMS
AT+XCSSMS
AT+XSMS
AT+XTESM
AT+CSDH
AT+CSAS
AT+CRES
AT+CMGC
AT+CSMP
AT+CGREG
AT+COPN
AT+COPS
AT+CREG
AT+CSQ
AT+XBANDSEL
AT+XCOPS
AT+XCSPAGING
AT+XEONS
AT+XREG
AT+XAACOPS
AT+XUBANDSEL
AT+XRAT
AT+CPLS
AT+CPOL
AT+XHOMEZR
AT+XCSQ
AT+CHUP
AT+CMOD
AT+CMUT
AT+CTFR
AT+VTS
AT+XCALLSTAT
AT+XDTMF
AT+XVTS
AT+CSTA
AT+CVHU
AT+VTD
AT+CCWE
AT+CR
AT+CRC
AT+XPROGRESS
AT+XREDIAL
AT+CAOC
AT+XLIN
AT+CCFC
AT+CCWA
AT+CHLD
AT+CLCC
AT+CLCK
AT+CLIP
AT+CLIR
AT+CNAP
AT+COLP
AT+COLR
AT+CPWD
AT+CSSN
AT+CUSD
AT+CCUG
AT+CBST
AT+CEER
AT+CGACT
AT+CGANS
AT+CGATT
AT+CGAUTO
AT+CGCLASS
AT+CGCMOD
AT+CGDATA
AT+CGDCONT
AT+CGDSCONT
AT+CGEQMIN
AT+CGEQNEG
AT+CGEQREQ
AT+CGEREP
AT+CGPADDR
AT+CGQMIN
AT+CGQREQ
AT+CGTFT
AT+XCGCLASS
AT+XDNS
AT+XGAUTH
AT+FCLASS
AT+CRLP
AT+XNVMPLMN
AT+XNVMMCC
AT+CBC
AT+CCID
AT+CCLK
AT+CFUN
AT+CGMI
AT+CGMM
AT+CGMR
AT+CGSN
AT+GSN
AT+CIMI
AT+CMEE
AT+CMUX
AT+CNUM
AT+CPIN
AT+CPWROFF
AT+CRSM
AT+CSCS
AT+CSIM
AT+CSVM
AT+CTZR
AT+CTZU
AT+IPR
AT+XCTMS
AT+XGENDATA
AT+XPINCNT
AT+XLOG
AT+XMER
AT+XSIMSTATE
AT+TRACE
AT+XL1SET
AT+XSIO
AT+XDLCTEST
AT+XPOW
AT+XCEER
AT+XEER
AT+XTRACECONFIG
AT+XMUX
AT+XFDOR
AT+XFDORT
AT+XCONFIG
AT+XAPP
AT+XHSDUPA
AT+XCAP
AT+CPIN2
AT+XDATACHANNEL
AT+CONNECTPORT
AT+CAMM
AT+CACM
AT+CCHO
AT+CCHC
AT+XCSP
AT+NEER
AT+CUAD
AT+XUICC
AT+XLEMA
AT+XSYSTRACE
AT+CLAC
AT+CPUC
AT+CLAN
AT+CGLA
AT+CRLA
AT+CPAS
AT+XSVM
AT+XNOTIFYDUNSTATUS
AT+XRXDIV
AT+XRXDIV3GRAB
AT+XMAGETKEY
AT+XMAGETBLOCK
AT+CPOS
AT+CPOSR
AT+CMOLR
AT+CMTLR
AT+CMTLRA
AT+XCPOSR
AT+XSETCAUSE
AT+XSPEECHINFO
ATV1 --> Enables verbose command results mode
ATE0 --> Turns off local echo
AT+SERIALNO=1,0 --> shows serial number
AT+CGSN --> shows IMEI
AT+XGENDATA --> shows modem version:
Code:
+XGENDATA: " SP6260_M0_MODEM_03.1241_DB121008 2012-Dec-10 11:25:46
PDB_NOT_AVAILABLE
*SP6260_M0_MODEM_03.1241*"
ATi --> shows device info:
Code:
Manufacturer: SAMSUNG
Model: I9300
Revision: I9300XXELL4
IMEI: XXXXXXXXXXXX
AT+HEADINFO=1,1 - Shows device information, "Unique Number" is not that unique. If you copy EFS you copy number.
Code:
+HEADINFO:1,1,1
Model Name = GT-I9300
Country/customer = -
Customer Code = DBT
Date = -
Charger = -
S/W version = I9300XXELL4
Unique Number = CVTXXXXXXXXXXXX
Memory Name = -
Sec Code = -
AT+IMEITEST=1,0 - shows "corrupted!!" with damaged EFS, not yet tested with good EFS
Code:
+IMEITEST:1,corrupted!!
AT+MSLSECUR=1,0 --> Some information I found indicates this is the first security mechanism. You need to send a device specific code to unlock write mode (AT+MSLSECUR=2,<UNLOCK CODE>). I saw examples in this form: AT+MSLSECUR=2,<SERIAL NUMBER>_<HEXADECIMAL KEY> but was not able to generate it.
AT+AKSEEDNO=1,0 --> It seems to be a challenge/response security mechanism: You have to respond to this challenge with another AT-command (AT+AKSEED=2,<RESPONSE CODE>). See next post for details.
Code:
AT+AKSEEDNO=1,0
+AKSEEDNO:1,16799-25-329
Some related technical infos
EFS:
The modem stores its settings in your /efs partition (mmcblk0p3), more precisely in your nv_data.bin file. It might be wise to do a backup. (More information on EFS)
Modem Firmware:
Your modem is running a Real Time Operation System (RTOS) named ThreadX. It is stored in modem.bin and different versions can be flashed by Odin.
The ServiceMode.apk-application talks directly to the modem RTOS.
AKSEED
This seems to be a challenge-response security algorithm. Maybe somebody has a clue as i would love to find out how it works.
I have collected some AKSEED examples from the web:
Challenge: 29987-125-1427 - Correct response: 16096-95-115
Challenge: 8299-182-209 - Correct response: 7928-94-124
Challenge: 767-207-25 - Correct response: 309-93-128
nv_data.bin
If you attempt to change the nv_data.bin within Android it will get restored from .nv_data.bak and .nv_core.bak. It is protected by a special MD5-hash which is stored in nv_data.bin.md5/.nv_data.bak.md5/.nv_core.bak.m5. The MD5-hash is generated from nv_data.bin, but can not be generated using a normal MD5-algorithm. If no backup is present a default nv_data.bin is created.
I assume the ril-daemon is responsible for checking the correct checksum and restoring the backup.
There are some offsets of interest in nv_data.bin (just assumptions, may be different on some modem firmwares):
I believe the modem settings related part starts at Offset 0x180000 with the String "SSNV".
0x181469 - Network Lock (i think its 5 bytes starting from 0x181469: Network Lock, Subset Network Lock, SP Lock, CP Lock, Data Lock)
0x18800F-0x188011 - Product Code (DBT,XEO,etc.)
0x188021-0x188023 - Product Code (DBT,XEO,etc.)
0x18815F-0x188165 - Serial Number
0x194004-0x194023 - Modem Version
0x194049-0x194053 - Firmware Version (I9300XXELL4,I9300XXDLIB,etc.)
0x18146e, 0x18148e, 0x1814ae, 0x1814ce, 0x1814ee - 5 times the same value, most likely a hash of the Unlock Code. The hashes are separated by "4A" hex. The hash is generated different than on SGS2 - see here
If anybody has further information regarding offsets, stored data and used encryption please post here or contact me!
MD5 generation: (cat nv_data.bin; echo -n Samsung_Android_RIL) | md5sum
EDIT: echo -n, not echo - n
Sent from my GT-I9305 using XDA Free mobile app
.NetRolller 3D said:
MD5 generation: (cat nv_data.bin; echo - n Samsung_Android_RIL) | md5sum
Sent from my GT-I9305 using XDA Free mobile app
Click to expand...
Click to collapse
nice one...but you have to stop ril-daemon on device before replacing or it will revert to nv_data.bin from backup:
Code:
stop ril-daemon
The data at 0x180004 to 0x180033 in nv_data.bin seems to be related to the AT+MSLSECUR command:
AT+MSLSECUR=1,0 on a phone with undamaged /efs responds the serial number:
Code:
AT+MSLSECUR=1,0
+MSLSECUR:1,RFXXXXXX
if you copy these offsets from undamaged /efs to another phone the data gets scrambled:
Code:
AT+MSLSECUR=1,0
+MSLSECUR:1,��Lb�šV��Ƨo~
if you edit these offsets to all "FF"s:
Code:
AT+MSLSECUR=1,0
+MSLSECUR:1,0000000000
so i assume it is somehow crypted by the serial number or another physical(?) unique identifier
AT+EGMR command
Does the AT+EGMR command work?
Warnings
All members of xda-developers, and the author can not be held responsible for any damage to any of your devices after applying the following
try at your own risk
1 ) Download and install Nokia care Sute 5 Latest Working
For Lumia 635 or otherirst Windows Phone 8.1 devices: RM-974, RM-975, RM-976, RM-977, RM-978, RM-979, RM-1010, RM-1027. link :- Nokia Care Suite PST 5.0 5.1.83.1414
2)you can use NaviFirm+ 3.2 (click here)
UPDATE :
first you need to know your mobile product code
if remove battery your product type and code will be printed there
or
open Extras + info you will see RM type like RM-xxx and choose your desired product code to flash
3 ) After installing Nokia care suite ,create a newfolder with a Name " Products" at C:\ProgramData\Nokia\Packages
it will become C:\ProgramData\Nokia\Packages\Products
Now create Your RM-xxx empty folder ,for lumia 1520 The folder name will be RM-937
in order to see hidden programdata folder click on show hidden folder in view
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
check your device product code list by searching like example "lumia 1520 product codes seidea.com" open first link all product code list will be there
,select Vietnam firmware for field test,in windows phone 10 10149 build we got field test by selecting 3G only in sim settings ,but we will have polling frequency and selective bands for battery save ,so i choose vietnam
in my case its look like "059V318 VAR APAC VN CV WHITE" Here VN= Vietnam.
for Lumia 1520 INDIA These are product codes which had "IN" at 4th place in sentance
059V3M9 VAR IMEA IN CV BLACK
059V3N0 VAR IMEA IN CV WHITE
059V3N1 VAR IMEA IN CV YELLOW
059V3N2 VAR IMEA IN CV RED
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
5) open Navifirm and it asks for login,so click on cancel
choose your 7 letter product type and paste at search bar and press enter as seen below
click on browse and navigate to C:\ProgramData\Nokia\Packages\Products\RM-937 clik ok
and untick "Use product code as final path"
see below screen shot
click on Download to Download All Files ,it takes Time According to Internet speed
if you done correctly you will see all downloaded firmware files at C:\ProgramData\Nokia\Packages\Products\RM-937
Now open Nokia care suite and click on Product support tool for store 5
6 ) click on file ---> Open Prouct and type your phone model and select correct rm of rour phone
7 ) click on programming and select recovery
8 ) click on updated list , your phone product number and all informaton willl display ,connect your phone click start
9 )it check data packages of Firmware ask for press volumue up+power button untill it vibrates ,do the same thing click retry
10 ) check at your phone screen flashin already started ,dont distruct flashing ,keep your pc awake untill it shows recovery completed
you will flashed to desired version of Firmware .you will get full sys freespace
It seems that Microsoft Care Suite has come out .
Really worry about the latest lumias` support by Nokia Care Suite , but can`t find a way to get Microsoft Care Suite as my Emergency Tool . I love flashing.
To delete.
anaheiim said:
There is no software called Microsoft Care Suite, at least not now (hope that Nokia Care Suite will not be abandoned, and will be updated).
Click to expand...
Click to collapse
Maybe. Hoping we can still get such powerful tool in the future.
anaheiim said:
There is no software called Microsoft Care Suite, at least not now (hope that Nokia Care Suite will not be abandoned, and will be updated).
Click to expand...
Click to collapse
Did't you find yet the way how to flash with NSU/LSRT every Lumia even 535 ? After changing PC sure we can
http://www.windowsmania.pl/poradnik...wariantu-oprogramowania-programem-lsrt-19445/
To delete.
cant see folder on step 8. already enabled hidden files. preferences set in here: C:\ProgramData\Nokia\Packages\RM-937\Products
OS: win7 64bit,
need this to try win10 on lumia 1520 using this tut that refers me here to increase sys space
http://forum.xda-developers.com/win...thod-how-to-install-windows-10-phone-t3044746
To delete.
trying/downloading it now. thanks. would you know any updated / clean win10 how-to for lumia 1520?
---------- Post added at 05:46 AM ---------- Previous post was at 04:58 AM ----------
i can see the downloaded ffu in the recovery/properties table but the START button stays disabled even after clicking the loaded firmware....
To delete.
i followed them step by step and, got a green sd card, but when i select the xap and apply the mod, the wpcustom will just exit and there is no cahnge in the icon of hacked pfd, when launched, pfd will just run as usual(connects to ms etc)
in the links you give, im on #6, it will not go to #7, the registry is not opened after executing #6. i have pfd on SDCard, i havegreen sd card permission....
4.Now you can see “SD Card Permissions” as green color.
5.After changing SD Card permissions click on browse xap button.
6.Browse and select Custom_pfd.xap from SD card and click Apply XAP Button.
7.After successfully applying custom_pfd tool to preview for developers goto Preview for Developers apps.
8.Now your phone is hacked and you can edit registry of your WP8.1.
>> i will be trying this one now since it seems there is not much i can do,
1. Download Firmware update with this product code 059V3T3 it should be version 02540.00019.14484.37003
and variant name "RM-937 VAR APAC TW CV BLACK", note the color doesn't really matter, the part that
matters is RM-937 VAR APAC TW CV, the FW is the same, so the color won't make any difference,
To delete.
if u want flash !?
try Austrailian Firmware , latest with Denim and had field test features(2g/3g/4gsignal lock),hope this will work after Windows phone 10 update
dont try to check ##3282 code in ffu with winhex ,just download and flash,it may change crc value,file will corrupted,check australian FWs version number for u r device and download
Get Ready for next WP 10 Preview 2(coming Soon)
hi,
i had download firmware for my lumia 735 but product support tool for store 5 not recognized my smartphone.
Help me, please.
Sicily98IT said:
hi,
i had download firmware for my lumia 735 but product support tool for store 5 not recognized my smartphone.
Help me, please.
Click to expand...
Click to collapse
does your firmware detected check the path ,use supplied data cable only,uninstall nokia usb driver in controlpanel restart connect your device ,it will install drivers automatically ,use win 7 or higher,sure it will detect
Next Build For Phones Coming on tomorrow 10th April Friday at 10AM pst,check your insider app and check for update ..this build got great features ,how already updated to WP 10, Enter correct Values in patched preview app,because all devices supported now,you will update to your phones relevent image,
be sure to have 300MB sys freespace ,check in insider app if not try my tutorial
Hello I am taking that error
DEV_REPORTED_ERROR_DURING_PROGRAMMING: 0x00030003
Exception:
Nokia.CareSuite.PlugIns.MurzimRecovery.RecoveryDialog.MurzimProgrammingException: DEV_REPORTED_ERROR_DURING_PROGRAMMING: 0x00030003
at Nokia.CareSuite.PlugIns.MurzimRecovery.RecoveryDialog.RecoveryDialogModel.Flash()
at Nokia.CareSuite.PlugIns.MurzimRecovery.RecoveryDialog.RecoveryDialogModel.<HandleDownloadVariantPackageCompleted>b__c(Object state)
Click to expand...
Click to collapse
My phone is stuck at recovery mode now. Can you help me please?
does your phone fully charged(>60%),you follow screen shots correctly,make your phone full charge (charge it for 2 hrs even though it's blank) then try again ,it will work-------------
billpao said:
Hello I am taking that error
Invalid response from device, incorrect message id
Exception:
Nokia.Murzim.InvalidResponseException: Invalid response from device, incorrect message id
bei Nokia.Murzim.Uefi.BootManager.MurzimBootManager.InfoQuery()
bei Nokia.CareSuite.PlugIns.MurzimRecovery.RecoveryDialog.RecoveryDialogModel.Flash()
bei Nokia.CareSuite.PlugIns.MurzimRecovery.RecoveryDialog.RecoveryDialogModel.<HandleDownloadVariantPackageCompleted>b__c(Object state)
Click to expand...
Click to collapse
My phone is stuck at recovery mode now. Can you help me please?
Click to expand...
Click to collapse
i get the same error with my lumia 920. i want to go back to wp8.1 instead of wp10
problem is:
-) lumia software recovery tool cant connect to the phone (i should press vol down and power, but that just restarts my phone and it still wont be recognized)
-) windows phone recovery tool just restarts my phone 3 times and also says, that it cant connect to my phone (i should press vol down and power, but that just restarts my phone and it still wont be recognized)
-) nokia care suite 5 ****s up with the above error message.
freakedenough said:
i get the same error with my lumia 920. i want to go back to wp8.1 instead of wp10
problem is:
-) Lumia software recovery tool cant connect to the phone (i should press vol down and power, but that just restarts my phone and it still wont be recognized)
-) windows phone recovery tool just restarts my phone 3 times and also says, that it cant connect to my phone (i should press vol down and power, but that just restarts my phone and it still wont be recognized)
-) Nokia care suite 5 ****s up with the above error message.
Click to expand...
Click to collapse
Main and important step is Phone Should vibrate if Tool trying to flash
simple steps
1) first place Firmware Appropriate folder
2) go to recovery--> start ,it will check firmware files first time and popup will come to retry
3> at this time hold volume down first it become 0 and vibrates
simultaneously hold power button without leaving volume down
shutdown slider will come don't touch it and wait until display off
then release power button for 1 sec and repress immediately
phone will vibrates, tool will start flashing process
high end devices like 1520 will vibrate volume down+power press at a time
its depend upon device ,if at a time doesn't work follow above method
I have a problem with no network, radio off .
my last chance is to load a good QCN
if anyone has one for the canada variant g350w
please share. Thank you;
if i need to make a walk through how to do this i will. i thought it was common knowledge.
if anyone is interested please post or pm. its quite simple . just requires the QPST Configuration program on a pc.
https://forum.xda-developers.com/sho....php?t=2263391 - program QPST
install QPST and then plug phone into pc.
Use samsung dialer menu *#0808*# to change usb connection to RNDIS+DM+Modem
That will force pc to update drivers etc, then open QPST and at the bottom right of main menu you will see " Add new Port" Click that and then uncheck the "show serial and USB/QC Diagnostic ports only" box
this will open up 3 (probly) different COM Ports , click on one and then click "add" at the bottom.
Repeat that until one shows up on the main menu with a (0) under the phone category.
When you have that one (0) then open the drop down from the top menu "Start Clients" and then select "Software Download" from that drop down.
once in that menu, you will select "Backup" on the top row of options, and then "browse" on the right hand side, you choose the COM port with the (0) from before there.
then select an area to place the file, or a name. it may have a default name already, if so you can rename or whatever you like or keep it the same. doesnt matter.
and press start.
This will make a backup of your QCN and save it to the location you specified.
That file is what i need to hopefully resurrect my phones radio.
With QPST you can do a lot of things, this is a very minor feature, I use it to put a QCN from aws enabled s4 to the non aws one and it makes the s4 now work on aws frequencies as the phone has the capability, its just the radio (QCN) thats stopping it.
If you know what to do you can enable different bands, change imei and much more with this program.
thread can be closed. i managed to get one from a broken phone but it isnt the fix i need.