Database Users

[GUIDE][18th Dec][4Noobs] Unlock The Xperia Play Bootloader

UPDATE (03th FEB 2013) This will wipe your internal storage (/data) but not your SD Card!
UPDATE (06th JAN 2013) : VIDEO TUTORIAL ADDED CLICK HERE
UPDATE:
IF the driver prompt does not show up
Press the windows key + r > and type "devmgmt.msc" and then press enter
Then find some sort of S1 Fastboot or android device in the list.
Right click it and press update driver
Browse > Fastboot and ADB Package > Drviers > X86 or X64 (32bit? or 64bit?) > usbwin > android_usb.inf
Also make sure you type the IMEI in correctly, if u unsure if it is unlocked or not try flashing a kernel via fastboot
Click to expand...
Click to collapse
OK so i was looking around for a easy to use guide i could refer someone to and couldn't find one so i decided to create 1.
With this method you wont need to download the android SDK and instead can download a small package of files that i will upload. this saves around 1-2GB of bandwidth.
Firstly we should confirm your phone can be unlocked. To check if your phone can be rooted (most likely if it is not branded to 3, Vodafone etc then it can be)
Go to the phone dialer
Tap*#*#7378423#*#* then a service menu should pop up,
Tap Service info > Configuration > Rooting Status. if it says boot loader unlock allowed then you are good to go.
if it says not allowed or no then you will need to pay to have the boot loader unlocked.
Now we need to get your IMEI to do this type in the dialer *#06# another window will appear with your IMEI number write this down somewhere as you will need it later.
OK so now that you know your phone BL can be unlocked we will need to download and extract these files
ADB and Fastboot Package - http://db.tt/B5vG1yn
Now we can begin. Turn of your phone. once the phone is off press and hold the search button while pluggin in the usb lead. the led at the top of the phone will be lit up BLUE. your computer should prompt you to install drivers for the new device if it does then select 'install manually' and browse to the location of the drivers, depending on your system architecture (X86 or X64) select the appropriate folder it should then install the drivers if you get any prompts about unsinged driver just install any way.
if something doesn't happen like it is suppose to please reply here or pm me.
Next we need to go to sony ericsson's bootloader unlock site read through to confirm you understand what your doing then click continue.
Click "yes i'm sure"
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ok now check both boxes and press i accept
now we need to fill in these fields (IMEI is the number you wrote down earlier if it doesn't work remove the last number and try again)
Press submit and you will see your Unlock Key copy it for later.
Finally after installing the drivers we will need to run the software called fastboot now to make it easier for you guys i have included a simple bat file which will load CMD at the correct location. so load run_me.bat and make sure the BLUE LED on your phone is still on. if it is then type this in to the new cmd window.
Code:
fastboot.exe -i 0x0fce oem unlock 0xKEY
replacing KEY with your key. for example
Code:
fastboot.exe -i 0x0fce oem unlock 0x726802F75671552D
your phone should now be unlocked. check my next guide on how to install custom recoveries, kernels and most importantly Android 4.0 (ICS)
Source: http://cyanlabs.co.uk/tutorials/unlock-play-bootloader

Thanks, but sadly mine says BL Unlock: No :/
If I pay for the unlock what happens then? Does somebody do it for me?
Sent from my Xperia™ PLAY using TapatalkHD

IrishStuff09 said:
Thanks, but sadly mine says BL Unlock: No :/
If I pay for the unlock what happens then? Does somebody do it for me?
Sent from my Xperia™ PLAY using TapatalkHD
Click to expand...
Click to collapse
hi yes but i cant remember who that is. maybe some1 will comment back on here saying. he is trusted member of XDA who has unlocked loads of peoples but forgot his name :S

His name is Alejandrissimo, contact him on unlock-bootloader.com to get it unlocked.

jasb92 said:
His name is Alejandrissimo, contact him on unlock-bootloader.com to get it unlocked.
Click to expand...
Click to collapse
yep him although the site isnt working.
EDIT: yes it is just really slowly

How does he do it?
TeamViewer??
Sent from my Xperia™ PLAY using TapatalkHD

IrishStuff09 said:
How does he do it?
TeamViewer??
Sent from my Xperia™ PLAY using TapatalkHD
Click to expand...
Click to collapse
yep. if i remember correctly he teamviewers with you, you have to put a paperclip on some test point on your phone, he uses some software which he has to pay for and then does some weird stuff and its done. that whats i read at least.

Nice clear and short guide, and you can see nicely how easy it is for the xperia play to achieve a unlocked bootloader in comparrison to other devices.
Isn't this supposed to go into the general section though?

fma965 said:
OK so i was looking around for a easy to use guide i could refer someone to and couldn't find one so i decided to create 1.
With this method you wont need to download the android SDK and instead can download a small package of files that i will upload. this saves around 1-2GB of bandwidth.
Firstly we should confirm your phone can be unlocked. To check if your phone can be rooted (most likely if it is not branded to 3, Vodafone etc then it can be)
Go to the phone dialer
Tap*#*#7378423#*#* then a service menu should pop up,
Tap Service info > Configuration > Rooting Status. if it says boot loader unlock allowed then you are good to go.
if it says not allowed or no then you will need to pay to have the boot loader unlocked.
Now we need to get your IMEI to do this type in the dialer *#06# another window will appear with your IMEI number write this down somewhere as you will need it later.
OK so now that you know your phone BL can be unlocked we will need to download and extract these files
ADB and Fastboot Package - http://db.tt/B5vG1yn
Now we can begin. Turn of your phone. once the phone is off press and hold the search button while pluggin in the usb lead. the led at the top of the phone will be lit up BLUE. your computer should prompt you to install drivers for the new device if it does then select 'install manually' and browse to the location of the drivers, depending on your system architecture (X86 or X64) select the appropriate folder it should then install the drivers if you get any prompts about unsinged driver just install any way.
if something doesn't happen like it is suppose to please reply here or pm me.
Next we need to go to sony ericsson's bootloader unlock site read through to confirm you understand what your doing then click continue.
Click "yes i'm sure"
ok now check both boxes and press i accept
now we need to fill in these fields (IMEI is the number you wrote down earlier if it doesn't work remove the last number and try again)
Press submit and you will see your Unlock Key copy it for later.
Finally after installing the drivers we will need to run the software called fastboot now to make it easier for you guys i have included a simple bat file which will load CMD at the correct location. so load run_me.bat and make sure the BLUE LED on your phone is still on. if it is then type this in to the new cmd window.
Code:
fastboot.exe -i 0x0fce oem unlock 0xKEY
replacing KEY with your key. for example
Code:
fastboot.exe -i 0x0fce oem unlock 0x726802F75671552D
your phone should now be unlocked. check my next guide on how to install custom recoveries, kernels and most importantly Android 4.0 (ICS)
Source: http://forgottencoders.co.uk/showthread.php?tid=36
Click to expand...
Click to collapse
i did a nandroid back up before unlocking my r800i and when im done unlocking i did restored my backup....is my BL still unlocked or it is locked again because of the restoration?....by the way +1 to you for making and effort the noobs...

d_zen said:
Nice clear and short guide, and you can see nicely how easy it is for the xperia play to achieve a unlocked bootloader in comparrison to other devices.
Isn't this supposed to go into the general section though?
Click to expand...
Click to collapse
Tbh it should prob be in either dev,apps & themes or general! Mod move it if you fell the same
GP18376A95 said:
i did a nandroid back up before unlocking my r800i and when im done unlocking i did restored my backup....is my BL still unlocked or it is locked again because of the restoration?....by the way +1 to you for making and effort the noobs...
Click to expand...
Click to collapse
Still unlocked also please press the thanks button rather than saying thanks
Sent from my Xperia Play using Tapatalk 2

fma965 said:
Tbh it should prob be in either dev,apps & themes or general! Mod move it if you fell the same
Still unlocked also please press the thanks button rather than saying thanks
Sent from my Xperia Play using Tapatalk 2
Click to expand...
Click to collapse
i just did before downloading your package...thanks again

GP18376A95 said:
i just did before downloading your package...thanks again
Click to expand...
Click to collapse
My bad
Sent from my Xperia Play using Tapatalk 2

Edit: nvm.
Sent from my R800x using XDA

Moved to general.
Please reply if you found this helpful.
Sent from my R800i using Tapatalk 2

When I Tap Service info > Configuration there is no rooting status option. Does that mean I have to pay? thanks.

baari21 said:
When I Tap Service info > Configuration there is no rooting status option. Does that mean I have to pay? thanks.
Click to expand...
Click to collapse

Awesome thread, one note that cdma aka xperia play branded with Verizon will absolutely have to get their bootloder unlocked with Alejandrissimo's help. My touchscreen broke on mine so I'm waiting on bestbuy to give me a new one 1st thing I'm gona do is unlock it.

cj360 said:
Awesome thread, one note that cdma aka xperia play branded with Verizon will absolutely have to get their bootloder unlocked with Alejandrissimo's help. My touchscreen broke on mine so I'm waiting on bestbuy to give me a new one 1st thing I'm gona do is unlock it.
Click to expand...
Click to collapse
thanks. it does say R800i in the title.
Sent from my R800i using Tapatalk 2

Thanks, downloading.....

spinoza23 said:
Thanks, downloading.....
Click to expand...
Click to collapse
thanks don't forget to press thanks button if you haven't already.
Sent from my R800i using Tapatalk 2

[SUCCESS] Interop-Unlocking LUMIA - with JTAG

Hi there
Well, as we really need Interop Unlock for our Lumia phones, i decided to check this out myself.
As i already have ATF Box for a long time, i decided to buy JTAG activation and dolphin clip + lumia jigs, that i do not have to solder my phone.
Also i have ordered a Lumia 520 testing phone on ebay.
So, as the ATF Team made an awesome JTAG software update, i'm trying to interop unlock that Lumia 520 the hardware way, as just software seems to be too tough...
Well, what i did so far:
1. Freshly flashed Lumia 520 RM-914 with latest stock rom
2. Did the setup/beginning after turning it on for 1st time
3. developer unlocked it with SDK on PC
4. Made Full Dump with JTAG from dev-unlocked phone
5. Mounted MainOS partition of dump with program "OSFMount" (-->appears as Local harddisk example drive E: )
6.Loaded the SOFTWARE hive with regedit on PC from "E:\Windows\System32\config"
7. Edited the following values:
PortalUrlInt = http://127.0.0.1
PortalUrlProd = http://127.0.0.1
MaxUnsignedApp = 10003
8. unloaded SOFTWARE hive
9. unmounted dump-image
10. wrote image back via jtag
I thought it might be a good Idea to dev-unlock the phone before messing with the registry, to make sure "DeveloperUnlockState = 1" gets written the "legal" way, as the key is not available in registry before.
Maybe it's better to just modify an existing key, than adding a new one...
Well, long story short: The result is not totally satisfying.
After writing the modified image back to the EMMC, the phone is booting up, but i can NOT deploy homebrew apps that require interop unlock, like @GoodDayToDies "EnableAllSideloading.xap" for example.
But i can deploy "nomal" apps like @cpuguys "Toastlauncher" and @GoodDayToDies "Webserver"
The weird thing: If i check the reg-values via WebServer on the Phone, i can see my edited values.
So the changes ARE written to the phone. The phone just doesn't use them...
So, the good thing: phone is booting with modified rom :good:
But, the bad thing: Changes are not working.
EDIT:
SUCCESS!!!
After adding
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
i could successfully sideload "EnableAllSideloading.xap"
After executing enableallsideloading i could sideload latest WPHTweaks build.
Now i have 3rd tile row enabled!
awesome!
Also member @myst02 is working on interop-unlocking the lumia phones. So we decided to make this a together-project.
See his achievements here: http://forum.xda-developers.com/showthread.php?t=2713098&page=10 :good:

reserved

to be able to sideload EnableAllSideloading.xap you need to change following registry key:
Software\Microsoft\SecurityManager\CapabilityClasses
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS
have fun.

I have found this during smurfing on the internet.
Dont know if this is something worth trying, but maybe it gives you some pointers or help.
http://windowsphonehub.in/tutorials...eloper-unlock-windows-phone-sideload-10-xaps/

lordmaxey said:
Well, as we really need Interop Unlock for our Lumia phones, i decided to check this out myself.
Click to expand...
Click to collapse
Good job!
lordmaxey said:
Let's get this rolling, guys! :good:
Click to expand...
Click to collapse
BTW, it's not a real "hack", and not acceptable/affordable for the 99.9% Lumia users and developers...

Wow you did a fantastic job
as @error0x0000034 mentioned you forget to open DeveloperUnlock_API
Software\Microsoft\SecurityManager\CapabilityClass es
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS

sensboston said:
BTW, it's not a real "hack", and not acceptable/affordable for the 99.9% Lumia users and developers...
Click to expand...
Click to collapse
Yeah, but it's at least something worth trying
ngame said:
Wow you did a fantastic job
as @error0x0000034 mentioned you forget to open DeveloperUnlock_API
Software\Microsoft\SecurityManager\CapabilityClass es
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS
Click to expand...
Click to collapse
Oh, i see...
I'm just wondering that this CAP was not secessary on Ativ S?
Or am i wrong?
I really thought it was just the 3 regkeys quoted in the first post...

lordmaxey said:
Yeah, but it's at least something worth trying
Oh, i see...
I'm just wondering that this CAP was not secessary on Ativ S?
Or am i wrong?
I really thought it was just the 3 regkeys quoted in the first post...
Click to expand...
Click to collapse
I don't remember Ativ S Interop but I know it had a BootStrap app
maybe that app unlock this api i'm not sure but I know you have to open this cap first to run EnableAllCapabilities

Nice work :good:
so now , you can make a small bussines with this
interop unlock for only *** $
and you are now the one and only interop unlocked retail Lumia owner

ceesheim said:
Nice work :good:
so now , you can make a small bussines with this
interop unlock for only *** $
Click to expand...
Click to collapse
Haha Yay, i'm going to be rich *lol*
ceesheim said:
and you are now the one and only interop unlocked retail Lumia owner
Click to expand...
Click to collapse
No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.
We'll see, but i'm curious
btw: Why are these damn smileys always displayed in the next line?

btw: Why are these damn smileys always displayed in the next line?
don't know , i just seen that too

lordmaxey said:
Haha Yay, i'm going to be rich *lol*
No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.
We'll see, but i'm curious
btw: Why are these damn smileys always displayed in the next line?
Click to expand...
Click to collapse
Samsung Bootstrap uses some Samsung-specific DLLs as far as I know. This won't help you, tried this already on my Huawei Ascend W1. This won't work on your Lumia either I think. But its worth a try of course.
You'll have to edit the registry key I mentioned before to be able to sideload EnableAllSideloading.xap. You need to load the SOFTWARE file from Windows/System32/config again into your registry and edit following key. Maybe try using a registry editor on your phone before using the method you described above, but I don't think that this will work. So, you probably have no other choice than opening up your device again and edit the SOFTWARE reg-file. Then sideload EnableAllSideloading.xap and you'll be able to sideload pretty much everything you want.
Question for more experienced devs and hackers:
Is there a registry tweak or some settings anywhere else on the phone that we can access though JTAG and that allows us to boot the phone (Lumia in this case) as a mass storage device with full filesystem access? Like on the Huawei Ascend W1. This would simplify the process of changing registry keys a lot.
Best regards and good luck.

lordmaxey said:
Haha Yay, i'm going to be rich *lol*
No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.
We'll see, but i'm curious
btw: Why are these damn smileys always displayed in the next line?
Click to expand...
Click to collapse
Bootstrap Samsung will not work on Lumia.

error0x0000034 said:
Samsung Bootstrap uses some Samsung-specific DLLs as far as I know. This won't help you, tried this already on my Huawei Ascend W1. This won't work on your Lumia either I think. But its worth a try of course.
You'll have to edit the registry key I mentioned before to be able to sideload EnableAllSideloading.xap. You need to load the SOFTWARE file from Windows/System32/config again into your registry and edit following key. Maybe try using a registry editor on your phone before using the method you described above, but I don't think that this will work. So, you probably have no other choice than opening up your device again and edit the SOFTWARE reg-file. Then sideload EnableAllSideloading.xap and you'll be able to sideload pretty much everything you want.
Click to expand...
Click to collapse
Like this then, right?
Ok, I'll try this next week, i sadly won't have time this weekend.
error0x0000034 said:
Question for more experienced devs and hackers:
Is there a registry tweak or some settings anywhere else on the phone that we can access though JTAG and that allows us to boot the phone (Lumia in this case) as a mass storage device with full filesystem access? Like on the Huawei Ascend W1. This would simplify the process of changing registry keys a lot.
Best regards and good luck.
Click to expand...
Click to collapse
No. once JTAG halts the phone, it's halted. You can't just "pause" the phone, make changes and continue booting. Sadly.
So, only chance is by writing the modified dump back.

It's not for Lumia only, it's a universal method for every WP8 devices (including emulator) that could enter MassStorage mode
And the Bootstrap app is not a magic, it use the system service by Samsung to modify the CapabilityClasses registry key mentioned by above and this could be done by modify reg hive directly

lordmaxey said:
Like this then, right?
Ok, I'll try this next week, i sadly won't have time this weekend.
Click to expand...
Click to collapse
exactly. I have done this on my Ascend W1 several times, but its easier, because I can enter Mass Storage Mode through bootloader.
No. once JTAG halts the phone, it's halted. You can't just "pause" the phone, make changes and continue booting. Sadly.
So, only chance is by writing the modified dump back.
Click to expand...
Click to collapse
I don't know how JTAG method works exactly, I only know that the device needed isn't cheap and can restore bricked phones. How it works? I have no idea, but I'm sure I'll learn quickly.
I will do some research on that soon. I'm a learning noob. :cyclops:
best regards,
error0x0000034

error0x0000034 said:
I don't know how JTAG method works exactly, I only know that the device needed isn't cheap and can restore bricked phones. How it works? I have no idea, but I'm sure I'll learn quickly.
I will do some research on that soon. I'm a learning noob. :cyclops:
Click to expand...
Click to collapse
Me neither
Most credits go to X-Shadow from advance-box team.
Because i had the Idea of modifying the phone dump and read/write via JTAG.
But usually, ATF only supported bootloader repair via JTAG. So i contacted X-Shadow and within only two weeks he updated the jtag-application, and added Custom Read/Write to every part of the EMMC.
That's how i could dump the rom, modify it and write it back.
Absolutely awesome work from that team, just releasing a software because of ONE single inquiry. :good::good::good:

Aw crap, I totally forgot to tell you to test a pure-interop app (like the bootstrap one). You interop-unlocked but failed to capability-unlock, and most WP8 homebrew requires both so of course you couldn't sideload it. DERP
But hey, if you successfully edited the capability class of ID_CAP_DEVELOPERUNLOCK_API - and it looks like you did, or could - then you can use EnableAllSideloading to capability-unlock the phone (it just edits all the other capabilities' classes). I could probably also write a "BootstrapNokia" app if you'd like; I think we have interop-based registry functions for WP8 Lumias, which would allow (for example) making SamWP8 Tools work on your Nokia as well.

SamWP8 tools on Nokia would be great.
I'll check that monday evening, when i'm back at my computer.
I'll keep you informed

GoodDayToDie said:
Aw crap, I totally forgot to tell you to test a pure-interop app (like the bootstrap one). You interop-unlocked but failed to capability-unlock, and most WP8 homebrew requires both so of course you couldn't sideload it. DERP
But hey, if you successfully edited the capability class of ID_CAP_DEVELOPERUNLOCK_API - and it looks like you did, or could - then you can use EnableAllSideloading to capability-unlock the phone (it just edits all the other capabilities' classes). I could probably also write a "BootstrapNokia" app if you'd like; I think we have interop-based registry functions for WP8 Lumias, which would allow (for example) making SamWP8 Tools work on your Nokia as well.
Click to expand...
Click to collapse
isn't it better to put FCROUTER and other samsung dlls in Windows folder?
as far as i know ID_CAP_INTEROPSERVICES allow it

Lumia 1520 Starting work on custom ROM !

Hi Everyone !!
Work on the first custom rom WP8 for Huawei w1 been completed successfully .
Time for something new !
I would like to announce that I start work on Custom ROM for nokia lumia 1520. First attempt at flashing the modified file ffu done successfully .
Unfortunately, in another attempt something went wrong. I switched the phone in Download mode, QPST can repair the phone but I dont have appropriate files (currently). I have Riff Box JTAG but this programator does not support L1520 and i need ATF jtag.
I'll keep you informed about the progress !! :fingers-crossed:
I collect money for the ATF and the new phone, otherwise I can't continue to work. In the future, project will be developed for many other devices with WP8.

Interesting. First of all: Congrats on the succesfull flash,
second of all: I hope you can resurrect your Lumia 1520 how did you get the 1520 to accept the modified rom though? Though Lumias check the signature after the flashing process has completed?

Thanks for congrats
I can ressurect my lumia in 2 ways:
1. I need have repair boot files for QPST
2. I need AFT JTAG
I have methods to cheat the verification process. In the same way I did in Huawei W1. :victory:
These are my priorities:
1. Development and refinement the ability to flash the modified FFU file.
2. Ability to run the phone in mass storage mode
3. Modification software
4. Adapting WP8CRUU for Luma 1520

WojtasXda said:
Thanks for congrats
I can ressurect my lumia in 2 ways:
1. I need have repair boot files for QPST
2. I need AFT JTAG
I have methods to cheat the verification process. In the same way I did in Huawei W1. :victory:
These are my priorities:
1. Development and refinement the ability to flash the modified FFU file.
2. Ability to run the phone in mass storage mode
3. Modification software
4. Adapting WP8CRUU for Luma 1520
Click to expand...
Click to collapse
Getting the boot files might be the trickier method, but you could try what I described in your other post. I guess the ATF Box is your best chance. I'll look through the 1520 update cabs maybe theres something in there that'll help you build the mbn boot image, like on htcs. (which are, for the 8s encrypted, for the 8x not, as far as I know.) If you feel okay with it you can shoot me a message with tips on how you managed to do that, if not, that's not a problem

WojtasXda said:
Thanks for congrats
I can ressurect my lumia in 2 ways:
1. I need have repair boot files for QPST
2. I need AFT JTAG
I have methods to cheat the verification process. In the same way I did in Huawei W1. :victory:
These are my priorities:
1. Development and refinement the ability to flash the modified FFU file.
2. Ability to run the phone in mass storage mode
3. Modification software
4. Adapting WP8CRUU for Luma 1520
Click to expand...
Click to collapse
Are you reading this thread: http://www.coolxap.com/forum-199-1.html ?
I received a lot of information about huawei w1 on this site. When read about it in December 2013.

Actually if the verification bypass works (which, knowing MS's tight security on Nokias, I highly doubt), it just needs to be released as a method, and after that, anyone can make their own custom ROM.
I'd definitely make some changes to the system (clear out some default apps, add some of my own, change the accent colours, allow interop and other caps to any apps, increase custom app limit), but that would break the built-in system updater. So beware modders, DO NOT use official updates when on modded firmware!

WojtasXda said:
Hi Everyone !!
Work on the first custom rom WP8 for Huawei w1 been completed successfully .
Time for something new !
I would like to announce that I start work on Custom ROM for nokia lumia 1520. First attempt at flashing the modified file ffu done successfully .
Unfortunately, in another attempt something went wrong. I switched the phone in Download mode, QPST can repair the phone but I dont have appropriate files (currently). I have Riff Box JTAG but this programator does not support L1520 and i need ATF jtag.
I'll keep you informed about the progress !! :fingers-crossed:
Click to expand...
Click to collapse
Hi,
I have an ATF Box (lordmaxey & me interop unlocked our Lumias with it, do you remember me ) and would like to help you. Feel free to PM me
Another question, did you just modify the .ffu file via Hex Editor? I've tried it myself a long time ago, but it didn't work and I had to repair it with my ATF. Is there a bug in newer Nokia FFU files?
myst02

feherneoh said:
Flashing the custom ROM is not hard, so I would give it a try
Just be sure you don't touch boot partitions, so you will be able to boot into flashmode
On L520, I could simply flash ANY ffu using CareSuite, so flashing works, just need idea, what to change in ROM
Click to expand...
Click to collapse
How are you able to bypass signature checking though? Funny how on Lumias you can apparently edit the MainOS Partition but cannot touch the Boot ones, and on HTC it's exactly the reverse.

Guys ... the only barrier that separates us from the Custom ROM are 2 files that i need to create and adapt to the device. I mean MPRG8974.mbn ((hex) and msimage8974.mbn . Anyone who has knowledge on this topic, please help !!
This is my other topic about mprg/misimage
http://forum.xda-developers.com/hardware-hacking/hardware/qpst-help-create-mprg-msimage-mbn-t2949492
Here is a lot of information about QPST
http://forum.xda-developers.com/showthread.php?t=2136738
how to build mprg and msimage [/url]
http://blog.csdn.net/ziyouwa/article/details/16331545

feherneoh said:
Start phone recovery process in CareSuite, select official firmware, press start
When it asks you, to connect the phone, just replace the ffu file with the modified one
Boot partition should not be touched, as the SoC checks its signature, and your phone will be stuck in quallcomm's DLMODE
Click to expand...
Click to collapse
how to modify FFU ? have you any tool for it ?
I know we can Convert it using ImgMounnt but how to reconvert it to ffu ?

feherneoh said:
Start phone recovery process in CareSuite, select official firmware, press start
When it asks you, to connect the phone, just replace the ffu file with the modified one
Boot partition should not be touched, as the SoC checks its signature, and your phone will be stuck in quallcomm's DLMODE
Click to expand...
Click to collapse
Okay, good, Are you sure that your phone will not reject the file when it encounters an error?
How do you think why was invented HSPL ?
For Huawei just enough to crack the flash tool in PC to be able to upload an unsigned app / ffu file. Phone does not validate the data but Huawei is different story. While working on the Custom ROM I used QPST with MPRG ,MSIMAGE, xml's and other files. JTAG also be useful. Without QPST not have been possible creating Custom ROM for Huawei.
Therefore necessary there is start working on the most needed things.
ngame said:
how to modify FFU ? have you any tool for it ?
I know we can Convert it using ImgMounnt but how to reconvert it to ffu ?
Click to expand...
Click to collapse
Do you think it is that simple? If yes, where are the custom roms? Where these modified files? Of course there are tools to build files ffu, signing and opening them, but they are not available for "ordinary" people.
Well ... I go learn and explore the dark side of QPST
Regards

WojtasXda said:
Okay, good, Are you sure that your phone will not reject the file when it encounters an error?
How do you think why was invented HSPL ?
For Huawei just enough to crack the flash tool in PC to be able to upload an unsigned app / ffu file. Phone does not validate the data but Huawei is different story. While working on the Custom ROM I used QPST with MPRG ,MSIMAGE, xml's and other files. JTAG also be useful. Without QPST not have been possible creating Custom ROM for Huawei.
Therefore necessary there is start working on the most needed things.
Do you think it is that simple? If yes, where are the custom roms? Where these modified files? Of course there are tools to build files ffu, signing and opening them, but they are not available for "ordinary" people.
Well ... I go learn and explore the dark side of QPST
Regards
Click to expand...
Click to collapse
I know it's not easy and simple and I know there's at least one tool to create and edit ffu files and it's also not public but i thought he developed a FFU Editor app ! or he flashed Custom Rom many times !
and also I think you mean Phone Image Designer of Microsoft :
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

feherneoh said:
I have used HxD hex editor to find the partition headers, then used OSFMount to mount them. You can either mount a part of the ffu, or copy the partition to a separate image
As far as I know (my bricked 520 proves it) SoC's built-in ROM checks the first partition's signature using the public key in Q-Fuse, so let's crack RSA and stuff like that. SPL/HSPL was used to load CE, NT on ARM uses UEFI
Click to expand...
Click to collapse
you bricked your phone when you try this way ?
If( YourAnswer == "Yes" )
{
MessageBox.Show("Surely This way can't be useful or it's not the complete way and we need to research more");
}
else
{
//More Details go here
}

feherneoh said:
This happened when I tried to modify first partition (shown in attachments in previous post)
I'm not sure, if I added that in this thread, too, but only try, if you have JTAG box, so you won't mess up everything
Click to expand...
Click to collapse
Unfortunately I have no JTAG box (riff , atf and etc.)
I will look for way you provide and check it .
I have to find someone with JTAG in Mashad,Iran . Is there anyone ?

it is necessary to learn how to create MPRG / MSIMAGE and use QPST Then jtag will not be needed. These files are obtained by reading the data from the memory EMMC in this case VHD would be the best solution.

OK OK your way worked
I could create 3 Partitions from my L920 (RM-821) Rom .
I couldn't access MainOS partition in this ROM .
sounds good to find this working way but need to work on it hours and hours .

feherneoh said:
Once found something like MPRG in ffu
Open another SoC's MPRG, and look for the first 8 0r 16 bytes in ffu file
Click to expand...
Click to collapse
I do not know if this is true, but MPRGXXXX.bin or MPRG.hex (Intel hex) suitable for many devices. Msimage is built only for the appropriate device.
@WojtasXda : Are you using caresuite to flash the rom, or do you have another tool?
Click to expand...
Click to collapse
Yes i have own tools for example WP8RUU or WP8CRUU

Things that might be of interest to a custom ROM developer:
* I've just made big progress in figuring out how capabilities work on the phone. Setting them via custom ROM is definitely one of the easier ways it might be done, if you can create arbitrary registry keys and set arbitrary values in them.
* One particularly valuable thing you could add to a non-Samsung ROM is the RPC driver/service/whatever that lets Samsung's RCPComponent library work. I don't know how hard it would be to hack that in, though. The binaries and the registry keys for the service shouldn't be hard to obtain, but I don't know if there will be problems with signatures or anything. Still, if you can get it working, this would mean that Samsung homebrew, and everything we can do with it (such as write arbitrary places in the registry and move files around as SYSTEM) becomes available on the 1520.
Somewhat relatedly, I find myself in need of a new phone (I think my ATIV S may be unrecoverable, and it wasn't even due to a hack I was doing!) and this piques my interest in getting a 1520...

feherneoh said:
Also (just an idea) RT certificates could be added. Maybe some(!) RT apps could run on the phones
Click to expand...
Click to collapse
These apps work now on WP8.1
wp8.1 supports appx and appxbundle formats so we don't have problem with running them on phones .
If you mean running apps like Multimedia 8 on phone I think we will run into resolution problem .

Not going to happen. First of all, the ported desktop apps only work when signature enforcement is off ("jailbroken") even *on RT*; until/unless we get a signature bypass for WP8 that's a complete non-starter.
The other major problem is that all the base libraries for RT are different than for WP. This extends all the way down to the really core stuff like Kernel32.DLL; RT (like normal Windows) has one, but WP8 doesn't (the functions are split into kernelbase.dll and kernel32legacy.dll). Then there's all the code (like support for the normal desktop interface) that WP8 just flat out doesn't have.
I'm not saying it's impossible to get RT code running on WP8... but it's probably easier to port the entire RT OS to the phone (which is *not* easy, but is possible) than it is to get RT software running on WP8 OS.

ZTE Maven 3

What's the likelihood of anything happening with the ZTE Maven 3? I understand it's pretty new but I literally can't even find any discussion on it.

I just picked the Maven 3 up today myself and I must admit I'm pleasantly surprised... It performs great considering it was only $30 brand new, and I love the fit & finish of it... Now just gotta try to be patient and hope for Lineage/ResRemix,TWRP,Root,Magisk,etc.... =)

It's apparently going to be $8 shipped from best buy on black friday. I think a lot of people will pick one up even if it were to be just an emergency phone.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Any news?
tge101 said:
What's the likelihood of anything happening with the ZTE Maven 3? I understand it's pretty new but I literally can't even find any discussion on it.
Click to expand...
Click to collapse
Have you found anyone thats rooted it?

Logos Ascetic said:
Have you found anyone thats rooted it?
Click to expand...
Click to collapse
No, I haven't found anything about it still. Hoping for at least roof, LOS would be a nice surprise.

I've found that QDLoader is activated in EDL mode (adb reboot edl; you will know you are in when the screen is off and nothing is happening) but I'm not sure how that's useful for us. fastboot and adb do not work in this mode. Volume down + Power button = FTM (field test mode) but I'm not sure what to do in that mode - you can use adb commands but you can't do anything special like mount system as r/w - no fastboot in this mode either. I also tried the ZTE Axon 7 tuliptool but that didn't detect anything (worth a try I guess). iRoot, srsroot, kingroot (pc & apk) don't root it in the FTM mode or regular OS. I've tried adb reboot disemmcwc thing to disable write protection but that didn't seem to do anything different. adb reboot bootloader only brings you to the regular OS. There is also a recovery, but that really only allows you to wipe data/cache and view logs, etc. (volume up + power).
There is an OEM Unlock option in the developer settings, but I still haven't found a way to get to use fastboot. Looking in the system, there are some debug scripts in the /system/bin folder, as well as busybox (toolbox & toybox included) which is interesting. The device is on 7.1.1 & security update "July 1, 2017" (any later exploits?). In "About", there is also a section called "Additional system updates" which seems to allow installing update packages from root directory on storage card?
I'm stuck there, as I'm not super knowledgeable in the art of rooting. Hopefully someone can figure this out!

Thanks for the information, Nick. I'm sure a lot of people got these for 8 bucks like I did just to play around with. I have no intention of putting a sim in it. I just want to use it as a music player with Google music. The main things I want to do are get rid of the preinstalled "locked" apps and unlock it to get rid of the activation nags. How did you get the developer options? When I tap on the Android build, I get this big N. For just over $20, I got a music player with 32 gigs for music. Not bad. I would love to get Aptx HD if we are able to get LineageOS or root it and install the codec but it's not a really big deal since I have it on my main phone. I just want to use this at work plugged in.

Tim Elliott said:
Thanks for the information, Nick. I'm sure a lot of people got these for 8 bucks like I did just to play around with. I have no intention of putting a sim in it. I just want to use it as a music player with Google music. The main things I want to do are get rid of the preinstalled "locked" apps and unlock it to get rid of the activation nags. How did you get the developer options? When I tap on the Android build, I get this big N. For just over $20, I got a music player with 32 gigs for music. Not bad. I would love to get Aptx HD if we are able to get LineageOS or root it and install the codec but it's not a really big deal since I have it on my main phone. I just want to use this at work plugged in.
Click to expand...
Click to collapse
Tap the build number 7 times. It worked for me.

Maven query
First, am I permitted to ask a technical question about this model here? I couldn't find a thread for any sort of Q&A, and starting my own would likely take a week to get a response. If not, kindly point me in the right direction please?
Note: My question is about how to retrieve the encryption key as I adopted my SD card to internal, and now it won't read it suddenly. I believe a file named (expand%s.key) is what contained the key, and I'm not sure how it was deleted. This happened after using Zarchiver and compressing about 700 images into a .zip with ultra compression, 256-bit encryption with password. After it finished the phone rebooted and didn't read the SD card upon boot.

I'm working on a terminal-only approach to rooting using the linux shell. I've got 4 books on linux checked out from the library including a command reference that's about 800 pages thick. If there's a way to root using the command line, I'll find it. Success could take a week or two depending on how many hours a day I put into this. It's also possible that there simply isn't a way to root from the command line only. Wouldn't it be nice though?

Maven root
denny777 said:
I'm working on a terminal-only approach to rooting using the linux shell. I've got 4 books on linux checked out from the library including a command reference that's about 800 pages thick. If there's a way to root using the command line, I'll find it. Success could take a week or two depending on how many hours a day I put into this. It's also possible that there simply isn't a way to root from the command line only. Wouldn't it be nice though?
Click to expand...
Click to collapse
It'd be nice if there were ANY way to root the Maven 2 or 3, I've tried pretty much every well know apk , without PC, & no root. Almost got it 1 time & started to try to remove some crapware & bam reboot.
I'm confused on the custom recovery / root thing. Seems like a chicken / egg ? Need root to install recovery but the root methods on Youtube all seem to start with them all having a recovery installed. You need to get a job but you have no experience, but you need experience to get a job...

Tim Elliott said:
Thanks for the information, Nick. I'm sure a lot of people got these for 8 bucks like I did just to play around with. I have no intention of putting a sim in it.
Click to expand...
Click to collapse
If you want to have some basic data, the Freedompop LTE SIM shows up as an ATT SIM in this device, so it works, even w/o unlocking. can get up to 400 MB of data free per month, along w/free VoIP minutes. While that data isn't going to get you streaming, it's more than enough for some IoT stuff.

Heres a little video i made of the Maven 3 running antutu benchmark.

ZTE Maven 3 ( SIM Mobile Network) Not Working
I am trying to use a ZTE Maven 3 from AT&T(US) in Africa (gift from a friend), but the mobile network (SIM card) is not active after inserting SIM. I've tried to search available mobile networks but I get the error message "error while searching for networks" after it tries searching for about 10 seconds.
My first thought was that the phone is locked to the AT&T network, but it did not prompt for an unlock code. I have had to reset the phone several times just to ensure that it gets to read the network. NB. (I have the network unlock code and have tried using it on the phone through alternate means to no avail) Is there anything I'm missing? I'll be glad to get your ideas. Thanks.

I am working on one also, looks like it might be a while, device is pretty locked up. Spent most the day today with my kali box trying to find any weakness. so far all I have found is that can be hacked with reverse_tcp in metasploit, not much else yet. Played with some Dirty CoW but didnt get to far with that, phone just hard reboots when the scripts are executed. If anyone else working on this wants to collaborate send me a pm.
I dont log on often but I get the notifications when I get a pm in my email
---------- Post added at 04:12 AM ---------- Previous post was at 04:01 AM ----------
000Nick said:
I've found that QDLoader is activated in EDL mode (adb reboot edl; you will know you are in when the screen is off and nothing is happening) but I'm not sure how that's useful for us. fastboot and adb do not work in this mode. Volume down + Power button = FTM (field test mode) but I'm not sure what to do in that mode - you can use adb commands but you can't do anything special like mount system as r/w - no fastboot in this mode either. I also tried the ZTE Axon 7 tuliptool but that didn't detect anything (worth a try I guess). iRoot, srsroot, kingroot (pc & apk) don't root it in the FTM mode or regular OS. I've tried adb reboot disemmcwc thing to disable write protection but that didn't seem to do anything different. adb reboot bootloader only brings you to the regular OS. There is also a recovery, but that really only allows you to wipe data/cache and view logs, etc. (volume up + power).
There is an OEM Unlock option in the developer settings, but I still haven't found a way to get to use fastboot. Looking in the system, there are some debug scripts in the /system/bin folder, as well as busybox (toolbox & toybox included) which is interesting. The device is on 7.1.1 & security update "July 1, 2017" (any later exploits?). In "About", there is also a section called "Additional system updates" which seems to allow installing update packages from root directory on storage card?
I'm stuck there, as I'm not super knowledgeable in the art of rooting. Hopefully someone can figure this out!
Click to expand...
Click to collapse
ZTE phone bootloaders are very secure, unless its part of the ZTE Open project, best we can hope for is a root solution, anything else is a pipe dream or is far far away.
Also not to crush your hopes, a majority of phones now show that OEM Unlock button even though there is not much you can do. Busybox is just toolbox. However that said, If you like I can get you a list of all busybox commands on the phone.

GidgetTheGnome said:
I am working on one also, looks like it might be a while, device is pretty locked up. Spent most the day today with my kali box trying to find any weakness. so far all I have found is that can be hacked with reverse_tcp in metasploit, not much else yet. Played with some Dirty CoW but didnt get to far with that, phone just hard reboots when the scripts are executed. If anyone else working on this wants to collaborate send me a pm.
I dont log on often but I get the notifications when I get a pm in my email
---------- Post added at 04:12 AM ---------- Previous post was at 04:01 AM ----------
ZTE phone bootloaders are very secure, unless its part of the ZTE Open project, best we can hope for is a root solution, anything else is a pipe dream or is far far away.
Also not to crush your hopes, a majority of phones now show that OEM Unlock button even though there is not much you can do. Busybox is just toolbox. However that said, If you like I can get you a list of all busybox commands on the phone.
Click to expand...
Click to collapse
I was also able to gain reverse_tcp meterpeter shell and attempted Dirty CoW with no results (not even a reboot ). Im no expert on Android but perhaps someone could use DRAMMER to bit flip the selinux policy to permissive and or gain temporal root?

FreakofN said:
It'd be nice if there were ANY way to root the Maven 2 or 3, I've tried pretty much every well know apk , without PC, & no root. Almost got it 1 time & started to try to remove some crapware & bam reboot.
I'm confused on the custom recovery / root thing. Seems like a chicken / egg ? Need root to install recovery but the root methods on Youtube all seem to start with them all having a recovery installed. You need to get a job but you have no experience, but you need experience to get a job...
Click to expand...
Click to collapse
LOL. Sorry FreakofN, not laughing at you but if your laughing I'm with ya. I too am playing with a Z835 maven 3 and though my knowledge isn't as advanced to rooting I am learning a thing or two here and there by reading, what I'm finding to be limited, discussion's on the topic related to this particular phone. Now I'm about to boldly reach out to the good people of XDA sporting this particular phone and show my smarts off by asking can someone please tell me where I can find the clipboard on this particular phone. LOL! ?? ROCK N ROLL!
---------- Post added at 09:10 AM ---------- Previous post was at 08:43 AM ----------
Eric1084 said:
It's apparently going to be $8 shipped from best buy on black friday. I think a lot of people will pick one up even if it were to be just an emergency phone.
Click to expand...
Click to collapse
WOW! good deal.

S999 Smart Watch MTK-6761: Stock Firmware, Unlock Booloader, Root, GSI Roms...

Hello guys, i open this thread as an open discussion about the S999 Smart Watch device which is working great !!
S999 (MTK-6761) maybe branded as:
- Lokmat APPLP Max
- JingTider S999
- BEESCLOVER S999
-...
I was able to get latest SP fLash Tools Firmware from Lokmat Support (V9-regular S999 for all devices) that can also fix imei/device ID...
Here is the link:
4G_H19_S999_EN_V0.9_P_user_20220611
I was able to one-click unlock bootloader using mtk-client (only works for me under Linux, but Windows Version available):
MTK-Client
Also, i played with some GSI ROMS flashed with SP Flash Tools, a lot of them works! But also a lot of them get both of the internal microphone/bluetooth headset activated so this results to an horrible "echo" of my voice during calls. Please someone can fix this?! or give a workaround?
The only rom i found that 100% works (no echo in bluetooth mode, but need to use Firefox for browser video playing) is Corvus OS A12 Official (i'm not an android dev so maybe you guys can found what makes bluetooth headset working with no echo in this rom and not in the others). I don't want to use A12 Rom i would prefer A10 or A11 but with bluetooth working!!!:
GSI ROMS List
Also i tried to port recovery to TWRP with no success, again, maybe you guys can port the recovery to custom one for this device?!
Here is the stock recovery extracted from stock rom above:
S999 Stock Recovery
The Corvus OS Rom is working great on this device, altought you need to pull off the sim card ("OK" button for sim code cannot be reached) on first boot to change DPI size (around 400).
Also after some charge/discharge cycles battery drain seems to be ok (maybe better than stock), but i'm also looking for a good "overlay" file/script to get this device working as best as possible, can someone do that?! (if you need something from stock rom .zip or SP Flash Read Back partitions/files i can provide it...

Hi, i ve also been playing with the same device. Currently running android 10 via crdrom rom. Works pretty okay although i havent tried out sim card functionality.
However i do have an issue, which im thinking could be hardware or MTK decided to do it, so i wanted to ask you of that also happens to you. So basically on all the roms i have tried out including the stock one, auto rotation doesnt work. Although i see accelerometer values using a sensor test app, but there is a orientation sensor from mtk which is always showing 0 and my autorotation just doesn’t work.
Did you experience the same? Also did you manage to find a trick to use heart rate sensor running custom rom?
Little tip: if you want to have the stock watch faces, you can extract these from the stock rom or in the worst case i can send them to you and then install them on your custom rom. They are essentially just live walpapers.
My setup:
-Crdrom android 10
-Using autogyro to manually change rotation to horizontal
-Microsoft launcher for app drawer, looks great in horizontal mode also
-Installed stock watch faces and set lock mode to none so i get the same functionality as on stock

laarSn said:
Hello guys, i open this thread as an open discussion about the S999 Smart Watch device which is working great !!
S999 (MTK-6761) maybe branded as:
- Lokmat APPLP Max
- JingTider S999
- BEESCLOVER S999
-...
I was able to get latest SP fLash Tools Firmware from Lokmat Support (V9-regular S999 for all devices) that can also fix imei/device ID...
Here is the link:
4G_H19_S999_EN_V0.9_P_user_20220611
I was able to one-click unlock bootloader using mtk-client (only works for me under Linux, but Windows Version available):
MTK-Client
Also, i played with some GSI ROMS flashed with SP Flash Tools, a lot of them works! But also a lot of them get both of the internal microphone/bluetooth headset activated so this results to an horrible "echo" of my voice during calls. Please someone can fix this?! or give a workaround?
The only rom i found that 100% works (no echo in bluetooth mode, but need to use Firefox for browser video playing) is Corvus OS A12 Official (i'm not an android dev so maybe you guys can found what makes bluetooth headset working with no echo in this rom and not in the others). I don't want to use A12 Rom i would prefer A10 or A11 but with bluetooth working!!!:
GSI ROMS List
Also i tried to port recovery to TWRP with no success, again, maybe you guys can port the recovery to custom one for this device?!
Here is the stock recovery extracted from stock rom above:
S999 Stock Recovery
The Corvus OS Rom is working great on this device, altought you need to pull off the sim card ("OK" button for sim code cannot be reached) on first boot to change DPI size (around 400).
Also after some charge/discharge cycles battery drain seems to be ok (maybe better than stock), but i'm also looking for a good "overlay" file/script to get this device working as best as possible, can someone do that?! (if you need something from stock rom .zip or SP Flash Read Back partitions/files i can provide it...
Click to expand...
Click to collapse
Hello, are there instructions on how to do this? I just got this watch and would like to see what it can really do. Thanks!
EDIT: Just a quick update...I've installed the MTK-Client for Windows. I now only need to understand how to use it to load an image to the smart watch.
Thanks much!

TheMixNation said:
Hello, are there instructions on how to do this? I just got this watch and would like to see what it can really do. Thanks!
EDIT: Just a quick update...I've installed the MTK-Client for Windows. I now only need to understand how to use it to load an image to the smart watch.
Thanks much!
Click to expand...
Click to collapse
Another update...I have the USB driver, Python, SP Flash Tool and MTK Client all operational now. I just cannot figure out how to get the watch into BROM mode to be able to connect. Android Development Studio actually does recognize when the device is plugged in but none of the apps seem to be able to read the device. Any suggestions?

You can Power Off the Device and start the Application (mtk client or whatever..) and let the Application wait for the Device.
Your Watch must be powered off AND DISCONNECTED FROM PC!!!!
While your Application is waiting for the Device please connect the POWERED OFF Watch to the PC.
This is the same procedure as you are flashing with SP-Flashtool, i asume so.
A Step for Step guide would be very nice and helpfull for "HOW TO UNLOCK THE BOOTLOADER" with MTK-Client.
I do not have one!

Actrapit said:
You can Power Off the Device and start the Application (mtk client or whatever..) and let the Application wait for the Device.
Your Watch must be powered off AND DISCONNECTED FROM PC!!!!
While your Application is waiting for the Device please connect the POWERED OFF Watch to the PC.
This is the same procedure as you are flashing with SP-Flashtool, i asume so.
A Step for Step guide would be very nice and helpfull for "HOW TO UNLOCK THE BOOTLOADER" with MTK-Client.
I do not have one!
Click to expand...
Click to collapse
Thanks much!
I did get it to connect using the method you described and SP-Flashtool. Too uncertain of what to do next to make any changes. It still doesn't connect to MKT-Client.

Hmm,
the owner of this Thred might help!
He did it successfully.
I did it with a different Method long time ago....
It´s CM2MT2 and the Dongle for it.
Yes, i payed for, but i love it because it is just working perfect and very simple too.
A simple description in the attachment, but i don´t know if it will help you!?
On what maschine you are working, Windows or Linux?
If Win you like to check the Drivers for the Watch in the Devicemanager of Windows there don´t has to be anywhere a yellow triangle.
If so a Driver is not correct installed. Until the yellow trinagle persists you have to troubleshoot and solve this first!

Actrapit said:
Hmm,
the owner of this Thred might help!
He did it successfully.
I did it with a different Method long time ago....
It´s CM2MT2 and the Dongle for it.
Yes, i payed for, but i love it because it is just working perfect and very simple too.
A simple description in the attachment, but i don´t know if it will help you!?
On what maschine you are working, Windows or Linux?
If Win you like to check the Drivers for the Watch in the Devicemanager of Windows there don´t has to be anywhere a yellow triangle.
If so a Driver is not correct installed. Until the yellow trinagle persists you have to troubleshoot and solve this first!
Click to expand...
Click to collapse
I'm on Windows...Yeah, already ran into a bit of troubleshooting with getting the Python modules properly installed before I was able to get the to MTK GUI. I am fairly technical and just haven't done this particular thing before; so, am starting from the beginning. My world is mostly PHP/CSS/SQL with some minor dabbling in other aspects. I've loaded images into ROMs before but on routers and such.
Any help is certainly appreciated...I appreciate the information!

kudicini said:
Hi, i ve also been playing with the same device. Currently running android 10 via crdrom rom. Works pretty okay although i havent tried out sim card functionality.
However i do have an issue, which im thinking could be hardware or MTK decided to do it, so i wanted to ask you of that also happens to you. So basically on all the roms i have tried out including the stock one, auto rotation doesnt work. Although i see accelerometer values using a sensor test app, but there is a orientation sensor from mtk which is always showing 0 and my autorotation just doesn’t work.
Did you experience the same? Also did you manage to find a trick to use heart rate sensor running custom rom?
Little tip: if you want to have the stock watch faces, you can extract these from the stock rom or in the worst case i can send them to you and then install them on your custom rom. They are essentially just live walpapers.
My setup:
-Crdrom android 10
-Using autogyro to manually change rotation to horizontal
-Microsoft launcher for app drawer, looks great in horizontal mode also
-Installed stock watch faces and set lock mode to none so i get the same functionality as on stock
Click to expand...
Click to collapse
Hi, yes same!
Simply use: Rotation apk

TheMixNation said:
Hello, are there instructions on how to do this? I just got this watch and would like to see what it can really do. Thanks!
EDIT: Just a quick update...I've installed the MTK-Client for Windows. I now only need to understand how to use it to load an image to the smart watch.
Thanks much!
Click to expand...
Click to collapse
Maybe you should learn more... there is no "image" to "load" via MTK-client...This tool is only to unlock bootloader. Also please try harder to learn by yourself = every commands and instructions are on the github page of mtk-client.
To flash new rom:
- Unlock Bootloader
- Enable USB Debugging in developper options
- Download and install adb/fastboot drivers and program for windows
- In windows terminal type:
adb reboot bootloader
- Then your device will reboot in fastboot mode
- Type:
fastboot erase system
fastboot flash system nameofyourrom.img
fastboot -w
fastboot reboot

TheMixNation said:
Thanks much!
I did get it to connect using the method you described and SP-Flashtool. Too uncertain of what to do next to make any changes. It still doesn't connect to MKT-Client.
Click to expand...
Click to collapse
If you can try with a live usb linux (ubuntu or something else)
Device powered off i only type:
python mtk e metadata,userdata,md_udc (errors allowed)
and
python mtk da seccfg unlock
then connected my device...= Instant unlocking
I also experiment trouble to get this device up under windows, go Linux

Actrapit said:
You can Power Off the Device and start the Application (mtk client or whatever..) and let the Application wait for the Device.
Your Watch must be powered off AND DISCONNECTED FROM PC!!!!
While your Application is waiting for the Device please connect the POWERED OFF Watch to the PC.
This is the same procedure as you are flashing with SP-Flashtool, i asume so.
A Step for Step guide would be very nice and helpfull for "HOW TO UNLOCK THE BOOTLOADER" with MTK-Client.
I do not have one!
Click to expand...
Click to collapse
Working on it dude! since hovatek community for this device including Russian guys seems dead ill post it here!
But if you read carrefully the Github page to the end, there is all the step by step guide to get this done!

laarSn said:
Working on it dude! since hovatek community for this device including Russian guys seems dead ill post it here!
But if you read carrefully the Github page to the end, there is all the step by step guide to get this done!
Click to expand...
Click to collapse
Hmm it was @TheMixNation who asked something, not me!
Did you realized this?

laarSn said:
Maybe you should learn more... there is no "image" to "load" via MTK-client...This tool is only to unlock bootloader. Also please try harder to learn by yourself = every commands and instructions are on the github page of mtk-client.
To flash new rom:
- Unlock Bootloader
- Enable USB Debugging in developper options
- Download and install adb/fastboot drivers and program for windows
- In windows terminal type:
adb reboot bootloader
- Then your device will reboot in fastboot mode
- Type:
fastboot erase system
fastboot flash system nameofyourrom.img
fastboot -w
fastboot reboot
Click to expand...
Click to collapse
laarSn said:
Maybe you should learn more... there is no "image" to "load" via MTK-client...This tool is only to unlock bootloader. Also please try harder to learn by yourself = every commands and instructions are on the github page of mtk-client.
To flash new rom:
- Unlock Bootloader
- Enable USB Debugging in developper options
- Download and install adb/fastboot drivers and program for windows
- In windows terminal type:
adb reboot bootloader
- Then your device will reboot in fastboot mode
- Type:
fastboot erase system
fastboot flash system nameofyourrom.img
fastboot -w
fastboot reboot
Click to expand...
Click to collapse
Thank you for so kindly steering me in the right direction.
I clearly need to learn more - hence the questions and statements indicating that I had not done this particular thing before.
That said, I have spent many hours thus far learning and managing to get the Python install to work on Windows without throwing module not found errors.
I had not indicated that I thought the image was to be installed via one app or the other, just that I had the programs set up and was looking for the correct order to do things in.
While they may not need to be "loaded" via the MTK client, the ROMs are still system "images" that get up"loaded"/written into the device's memory.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

laarSn said:
Hello guys, i open this thread as an open discussion about the S999 Smart Watch device which is working great !!
S999 (MTK-6761) maybe branded as:
- Lokmat APPLP Max
- JingTider S999
- BEESCLOVER S999
-...
I was able to get latest SP fLash Tools Firmware from Lokmat Support (V9-regular S999 for all devices) that can also fix imei/device ID...
Here is the link:
4G_H19_S999_EN_V0.9_P_user_20220611
I was able to one-click unlock bootloader using mtk-client (only works for me under Linux, but Windows Version available):
MTK-Client
Also, i played with some GSI ROMS flashed with SP Flash Tools, a lot of them works! But also a lot of them get both of the internal microphone/bluetooth headset activated so this results to an horrible "echo" of my voice during calls. Please someone can fix this?! or give a workaround?
The only rom i found that 100% works (no echo in bluetooth mode, but need to use Firefox for browser video playing) is Corvus OS A12 Official (i'm not an android dev so maybe you guys can found what makes bluetooth headset working with no echo in this rom and not in the others). I don't want to use A12 Rom i would prefer A10 or A11 but with bluetooth working!!!:
GSI ROMS List
Also i tried to port recovery to TWRP with no success, again, maybe you guys can port the recovery to custom one for this device?!
Here is the stock recovery extracted from stock rom above:
S999 Stock Recovery
The Corvus OS Rom is working great on this device, altought you need to pull off the sim card ("OK" button for sim code cannot be reached) on first boot to change DPI size (around 400).
Also after some charge/discharge cycles battery drain seems to be ok (maybe better than stock), but i'm also looking for a good "overlay" file/script to get this device working as best as possible, can someone do that?! (if you need something from stock rom .zip or SP Flash Read Back partitions/files i can provide it...
Click to expand...
Click to collapse
Thank you for opening this thread. Can you please share some screenshots of the home screen of the smartwatch S999 with Corvus OS A12 Official (which you mentioned) ?

@laarSn @kudicini l know you guys are busy, but can you please post a screenshot of the S999 watch's homescreen or maybe sum more fotos how it looks ? Thanks in advance

Freemaurer said:
@laarSn @kudicini l know you guys are busy, but can you please post a screenshot of the S999 watch's homescreen or maybe sum more fotos how it looks ? Thanks in advance
Click to expand...
Click to collapse
View attachment 5828415View attachment 5828417Hi These are some of the screenshots,I actually didnt do any modifications, didnt really have time to play that much with it, initially i ve bought it to use while on work, for teams, but still havent used it, it was actually turned off for the last month or so haha
Anyway, I m using Microsoft Launcher, I find it really great since I can use it in horizontal mode, which is the only natural way of using this device since the width is too small and you re anyway gonna be using it while on wrist (for most stuff). I ve set no lock screen and instead use button to lock/unlock which makes it more similar to smartwatch. The big clock you can see is actually one of the clocks from the original image, since I ve figured out the original clock images on the original image are just live wallpapers, so you can actually use it on your custom rom also, however the multi functional clocks work partially, depending on what you click and also any clock image using heart rate monitor will fail.
If you want heart rate monitor I ve also found one app that actually works on this device, but personally I dont really use it. For the above mentioned problem of horizontal rotation, i am using autogyro app which works pretty well.

laarSn said:
I was able to get latest SP fLash Tools Firmware from Lokmat Support (V9-regular S999 for all devices) that can also fix imei/device ID...
Here is the link:
4G_H19_S999_EN_V0.9_P_user_20220611
Click to expand...
Click to collapse
I'm dying to try this out, but I am unable to download this file. Do I need to request access somehow?
Thanks for this awesome work! I thought my S999 was destined for the junk pile until now.

Try this:
S999 Bootloader unlock - Page 9
(05-12-2022, 02:51 PM)maxpayne Wrote: (03-12-2022, 08:58 AM)laarSnn Wrote: Hello guys, i have some good news for you i was able to get latest SP fLash Tools Firmware from Lokmat Support (V9-regular S9
www.hovatek.com

Newfred said:
I'm dying to try this out, but I am unable to download this file. Do I need to request access somehow?
Thanks for this awesome work! I thought my S999 was destined for the junk pile until now.
Click to expand...
Click to collapse
Try again it should works: https://drive.google.com/file/d/1K6J7WBVaHP96lk41ZDn2FVAC7WarRABt/view?usp=sharing