Database Info

Vox bootloader

Inspired by some threads in the Hermes and Trinity forums I started to explore the VOX bootloader. You can enter the bootloader by pressing the camera and power button at the same time. You see the tri-color (red/green/blue) bootscreen which shows the bootloader and CPLD version. In connection settings of activesync uncheck "allow USB connections" and connect PC and Vox with a USB cable. The PC will recognize the Vox and install an interface driver.
You need the MTTY to talk with the bootloader and send it commands. The Hermes wiki provides some good information and also has a link to MTTY:
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader
Unfortunately the Vox bootloader (v1.16.0000) doesn't display help information. The first command you should enter is password. I found a password for Trinity and Hermes which also works for Vox:
password BsaD5SeoA
Here are a couple of other commands which work: emapiWlanEERW, emapiInit, emapiWlanMac, emapiPwrDwn, emapiRead, emapiTest, emapi, cpldver, DumpReservoir, CheckImage, calcrccheck, getdevinfo, ruustart, ruurun, progress, wdata, password, mbr, set, atcmd, ResetDevice, BTRouting, BTTestMode, SetDebugMethod, IMEI, ls, lnbs
I would like to find a way to dump the SPL and ROM to SD-card or to PC. I tried a couple of things (r2sd, d2s) to no avail.
Anyone else some ideas?
Update1
I got stuck in the bootloader and luckily found how to boot into the OS again:
http://forum.xda-developers.com/showpost.php?p=1094479&postcount=11
password BsaD5SeoA
ruurun 0
ResetDevice
Update2
I discovered the 'ls' command. Afaik it allows to dump the rom parts like SPL, IPL, splashscreen when the device is CID unlocked. My unbranded S710 is SIM unlocked, but unfortunately not CID unlocked. When I issue 'ls' there's a "not allowed" error

Update3
I found a 'good' VOX ROM upgrade (the ones on the XDA FTP are all corrupt): RUU_Vox_HTC_WWE_1.15.405.2R4_4.1.13.37_02.83.90_Ship
Another upgrade ROM is the Dopod:
RUU_Vox_DOPODASIA_WWE_1.19.707.3_4.1.13.37_02.83.90_Ship
I used NBHextract.exe to extract both ROMs. The SPL bootloaders are attached.
NBHextract shows following info for the 1.15 Vox ROM upgrade:
Code:
Device: VOX010100
CID: HTC__001
Version: 1.15.405.2
Language: UK
Extracting: 00_IPL.nb
Extracting: 01_SPL.nb
Extracting: 02_GSM.nb
Extracting: 03_MainSplash.nb
Encoding: 03_MainSplash.bmp
Extracting: 04_OS.nb
and this for the Dopod upgrade:
Code:
Device: VOX010100
CID: DOPOD001
Version: 1.19.707.3
Language: USA
Extracting: 00_IPL.nb
Extracting: 01_SPL.nb
Extracting: 02_MainSplash.nb
Encoding: 02_MainSplash.bmp
Extracting: 03_GSM.nb
Extracting: 04_OS.nb
Update4
I managed to back up my S710 using itsme's "bkondisk" tool and "prun" from his itsutils suite here and here. Copy bkondisk.exe to /Windows on your device.
After running this on your PC
Code:
prun bkondisk.exe "\Storage Card"
following files are created in \Storage Card and a log file "bkondisk.log" in \
Code:
bk_00_0000.img - IPL : ONBL1 + ONBL2
bk_02_0005.img - GSM + splash + gsmdata + simlock + serialnrs
bk_03_0025.img - OS
bk_06_0001.img - SPL
bk_08_0205.img - userfilesystem
I compared a couple of these .img files with the .nb files extracted by NBHextract from an official RUU. The IPL and SPL look quite okay, but the OS is mapped totally different. So don't think you can just rename for example bk_03_0025.img to OS.nb in order to have a flashable file !! I have attached my dumped SPL which is version 1.16
Next mission is to find a 'good' (not corrupted) version of the RUU_Vox_HTC_WWE_1.15.405.2_4.1.13.37_02.83.90_Test.exe ROM upgrade. See this Excalibur thread. I think the same applies to S710
Update5
With Dark Simpson's htc rom tool here it is possible to create a flashable image file from separate .nb files. There is also Dutty's good NBHtool 1.1 yet, but so far I haven't tried it.
What we still need to have for flashing unsigned ROM images is a SSPL. See here and here.
Alternatively we need a so called Update SPL (USPL) which unlocks CID and then allows flashing any rom to your device. The version for the ELF created by the brilliant moderator pof can be found here. Since the ELF is very similar to VOX, I will study it and see if I can use it to implement a SSPL (software SPL) which allows us to also flash any ROM, but does not require to flash an USPL. I think flashing IPL and SPL is a bit too tricky atm.

Take the Elf USPL, remove the RUU folder (to be sure you don't flash anything by mistake), in the LOADER folder change the .nb file for a Vox bootloader (different version than the one on your device) and use the same name for the .nb file, then run elf-uspl.exe on your PC.
If elf & vox are so similar, this should jump to the bootloader you've placed in the LOADER folder, to check it disable activesync usb connections and go into bootloader with mtty. Do an "info" command or whatever identifies that the bootloader you're seeing is the one you've placed on the LOADER folder and not the one actually on your device.
If you succeed in loading a custom bootloader I can help you with the don't check cid / don't check signatures... patches
Good luck!

Thanks for replying pof. I did as you said and tried it with spl 1.15 (whereas 1.16 is flashed on my S710). First I went through step1 and then went in to step2 where at 75% the screen got blank and it rebooted the phone in my native bootloader 1.16 RUU mode. I suppose that's not what we wanted to see?

Where did you find RUU_Vox_HTC_WWE_1.15.405.2R4_4.1.13.37_02.83.90_Ship? Do you have a link?
Thanks

I found it here:
http://www.leaf.co.za/Members/Member Services/Manage My Profile/

Cant Find The Bootloader For The Life of Me
Tried:
"You can enter the bootloader by pressing the camera and power button at the same time. You see the tri-color (red/green/blue) bootscreen which shows the bootloader and CPLD version."
No Luck. I must be thick. Its gotta be just that easy... but...
The S710 simply boots into my home screen.
Can someone PLEASE post a (little) more detail about how to boot into the bootloader on the s710/vox?
THANKS.
Cheers.
** EDIT **
OK- Better bootloader entry instructions for SP noobs (like myself):
1) Turn device off
2) Unplug power/usb cable from handset
3) Press and hold camera button
4) Plug power/usb cable into handset
5) Be amazed by Blue-Green-Red Bootloader screen.

Yeah, it won't boot in bootloader mode if the usb cable is connected. Well, it's sometimes better to find out things all by yourself
Besides, I don't think anyone other than myself is researching this stuff on Vox. Too many ordinary users and nearly noone in to h*cking.
You don't have 1.04 on your phone by any chance?

RE: older bootloader
No joy.
Sorry.
Its 1.15
My SP has vanilla mods.
Its just out of the box the last 4 days in NYC!
The phones not even available AFAIK in the US yet-- except special order.
Got mine in London last week.
Still working out the kinks.
BTW:
Im looking for info/docs/someone who has forced GSM codec through WM6 to this handset through Asterisk LOCALLY-- Asterisk SIP logs show successful codec negotiation and initial start of audio delivery-- but the stream pukes out on my handset immediately-- ideas? Im begining to think it may be a cpu issue. Thanks.

850mph said:
BTW:
Im looking for info/docs/someone who has forced GSM codec through WM6 to this handset through Asterisk LOCALLY-- Asterisk SIP logs show successful codec negotiation and initial start of audio delivery-- but the stream pukes out on my handset immediately-- ideas? Im begining to think it may be a cpu issue. Thanks.
Click to expand...
Click to collapse
Yeah saw that. I don't think it's a CPU issue, could run GSM codec just fine on a stone old iPaq. Try trunning omap overclocker and set it to 240MHz and see if it makes a difference. Keep using the SIP thread for any replies on this

POF's O2/Nova Solution
jockyw2001-
I suppose youve seen Pof's post #89 (dated 4-8) in the "ELF Update SPL (USPL)" thread which calls for running enable-rapi.cab (on O2 Nova) BEFORE elf-uspl.exe?
Id try it myself but want a few days of joy with my handset BEFORE creating a potential brick.
From my reading if the elf-uspl.exe makes it to 75% in stage 2 before white-screening-- you're close (well, 75% anyway.. wink!). Seems like Pof could have a couple of suggestions at that point. Maybe hell be kind enough to comment?
You're on it.. but I thought Id ask.
Cheers.

Heres something I am trying to work out-- even after many hours of reading:
I understand that there is an exploit in the 1.04 bootloader which can potentially bypass CID and Certs when flashing a new ROM image on both SPs and PPCs..
I also understand that bootloaders 1.09+ cant be downgraded.
So am I right in assuming that potential VOX ROM-chefs have at least ** TWO ** potential paths to solving the bootloader issue:
1) Find a 1.04 bootloader **AND** a tool which will load it successfully
-- Then use the exploit (which I read about-- but cant find) to flash the ROM
-or-
2) Find a way to Flash **ANY** bootloader onto the vox with elf-uspl.exe
-- Then (keeping our fingers crossed) elf-uspl.exe can be patched to defeat the CID&CERT issues with the vox
Now heres the question:
I am right in assuming that we **DONT** need to find a way to flash **SPECIFICALLY** the 1.04 bootloader onto the ROM **BEFORE** we can take advantage of a patched elf-uspl.exe?
Is that correct?
Cheers.

Oh yeah.. AM I right in assuming that the WM5/6 bootloaders are EXACTLY the same code (except for dated revs) across all WM SP and PCC devices-- sort of like the ability to install grub or lilo on **ANY VENDORS PC** no matter what OS or eventual Software Packages end up on the box?
Looked at another way:
When they talk about the 1.15 bootloader in the Blue Angel Board they are talking about the EXACT SAME 1.15 bootloader in the VOX board?
I mean, I know this is gotta be the case but I need a little reassurance here-- As Im still a bit confused on why PPC software should run on SP devices-- even understanding that they use (generally) the same subset (WM5/6) of the CE5/6 API-- But have different CPUs.

850mph: cool to see there actually are brothers in arms
I've tested pof's USPL extensively, but haven't got it to work (yet).
Actually you need to run enable-rapi.cab only if your phone isn't yet application unlocked, i.e. if it doesn't allow to run unsigned apps. Mine is application unlocked so I can skip that step.
The next step is to load a modded SPL in RAM at physical address 0x10000000 and to run it. Once this modded SPL is running another modded SPL can be flashed.
I've tried to load an unmodified SPL in RAM (e.g. SPL 1.15) and to run it. This can be done with following 2 steps:
1) psetmem.exe -f -p 0x10000000 spl.nb
2) run haret.exe on device (can use cecopy & cerun); cerun -b CE:\haret.exe
Note: haret.exe is a linux kernel loader which was modified by pof to run a USPL from 0x10000000
What happens is that my phone reboots into the stock bootloader (SPL 1.16) in RUU mode. I have to use MTTY in order to boot the phone in WM again (see post #1 and #2 in this thread).
Actually I think haret.exe does run the SPL 1.15 which is loaded in RAM, but that at some point the code resets the device.
I'm quite sure we can run a specially prepared USPL or SSPL which allows flashing another specially prepared SPL such that the device is effectively CID unlocked which again means that any vendor's firmware can be flashed. I also think we don't absolutely need the SPL 1.04 for that purpose.

This is good info.
I see what you are trying to do now.
Im gonna take some time to get up to speed on Dumping/Reading/Flashing from the Trinity Hermes and Elf pages. Until then Im afraid Ill be of little use.
Until now Ive strictly been a Linux/GCC-guy. Im tempted (but not convinced) that I want to take the time to learn Microsofts WM5/6 IDE. Its a time issue (obviously).
But I will spend some time on the whole S710 ROM-cooking (and bootloader) issue this week. It looks manageable.
I see you have basically been mixing and matching the various ROM cooking tools-- including using Msofts CE powerToys. Is there no single suite (besides the ImagefsTools) which you can recommend I look at first (With the understanding we need to solve the bootloader issue specifically for the vox first)-- I see various kitchens for various devices. Do any of them see plausible as a starting point for an HTC/Vox kitchen suite?
GOOD LUCK.
Cheers.
** EDIT **
I REALLY think the S710/S730spec are GREAT devices-- couple of minor issues-- but just fantastic form-factors.

new in the sandbox
Hi guys,
I just got my XPA 1415 some days ago (for info, it's just the same than the others (HTC S710, SPV E650 and Vodafone V1415, VOX, ...) but from Swisscom (Swiss provider).
I've been reading around and found this thread that was the most related. I actually tried to use the techniques provided by jockyw2001 with no luck.
Doing a prun bkondisk does not work, neither any of the itsutil tools. I do think that my device is somehow protected, but I've no clues how to proceed next. I'm going to continue searching, but if any of you has an idea, it's more than welcome.
If I manage to dump that *damned* ROM, I'll make it available...
I've currently (on booloader ONBL 1.23.0000, SPL 1.23.0000, CPLD 04)
Cheers,
Nick

Nevermind...
I think I've been able to proceed with the backup (I've used the Microsoft Security Configuration Manager) when I realized that my system (Windows 2003 x64) the tool was not working.
Which made me think that maybe the procread and the other prun bkondisk might also have been blocked by the x64.
I've tested on my laptop (regular XP) and it works fine... just FYI !
** EDIT **
I've also tested the ELF haret with a downoaded SPL and I got the same result as jockyw2001...
BTW, jocky, did you find a way to re-create a proper nh from the bkondisk end result (bk_##_####.img) ?

nwaelti said:
BTW, jocky, did you find a way to re-create a proper nh from the bkondisk end result (bk_##_####.img) ?
Click to expand...
Click to collapse
The IPL and SPL are useable. The radio dump called bk_02_0005.img is from offset 0xA0000 identical to the radio rom. The first 0xA0000 bytes are other parts, probably splash + gsmdata + simlock + serialnrs. The OS file seems not directly useable and must be reordered somehow. More interesting is the ROM reconstruction method described here. Of course first we need to be able to flash unlock the Vox. I think the SSPL is most suitable for this purpose, this may need some reversing of the SPL with IDA Pro.

Thanks for those info, I'll try to go in that direction. Would be nice to find which one is splash, which one is gsm and the others below 0xA000.
I know we need to rev. SSPL. Don't exactly know where to start though I can't flash mine with any original ROM as Swisscom is not providing any.
BTW. viewimgfs gives me back a "packing DLL not found" (or some similar). Anyone had that also ?
I'll try to download IDA Pro...

It's below 0xA0000
I will do some testing again with the Vox today. I will see if I can paint the screen with a few instructions @0x10000000
I think I can not just run the SPL on VOX in the same way as you can on the ELF. The IPL on the VOX is 128kB, whereas on ELF it is only 2kB. So I think I will have to patch the IPL and run that first. I'm afraid that it will take a bit more time. Basically it will then be a SSPL (search forum for SSPL and user 'des') with both IPL and SPL patched and running in RAM.
But maybe it is also possible to patch just the SPL, because it could be that the default action initiated by IPL is to reset the device in RUU bootloader mode.
Given some time it can all be done I'm sure

How to get a Kaiser to display Chinese ?

Hi everyone, I just got my first smartphone, an AT&T Tilt (HTC 8925) a couple of days ago. I'm happy with it except that I wish it to display Chinese when browsing webpages. I don't need the interface to be Chinese, nor do I need to input Chinese. I just wish when I visit a Chinese website, I'm not seeing blocks.
Don't know if this makes a difference, but either traditional or simplified Chinese would work (I read both).
Searching the whole forum didn't give me much. Probably people had some discussions before, just I didn't find them yet.
I'm totally new on smartphones. Any help is very much appreciated.
info on the phone:
ROM version: 3.57.502.2 WWE (since shipped I didn't flash the ROM)
ROM date: 07/17/08
Radio version: 1.65.21.18
Protocol version: 25.88.40.05H
I just flashed the SPL to Kaiser-HardSPL-3.56 following instructions. BTW, which version should I use, 3.56 or 3.29/28?
I did not flash the ROM, b/c I'd like to find out more on Chinese language support.

Install this cab and it will perfectly display Chinese. It is suitable for almost any WM5,6,6.1 rom :http://www.51spsoft.com/DownInfoEn/info26059.html
Or direct download link: http://www.51spsoft.com/Download.asp?ID=26760

Miraco said:
Install this cab and it will perfectly display Chinese. It is suitable for almost any WM5,6,6.1 rom :http://www.51spsoft.com/DownInfoEn/info26059.html
Or direct download link: http://www.51spsoft.com/Download.asp?ID=26760
Click to expand...
Click to collapse
Be sure to backup your device before you try. I am not responsible for any data lost. Your might need a hard reset if it failed... But it is the cab that I have been using for English roms for many devices and it will likely work for you too

you shoud find a chinese font file'ttf',and repair reg
try this websit
www.ioicn.com.cn

well.. this is what i use only...
http://www.studiokuma.com/wm/?section=support

1. CE Star chinese
2. Monster chinese
3. Many font + wince.nls + registry mentioned above.
4. My rom (see signature below)

Thank you very much.
I'm now downloading and trying the ways you pointed out.

Miraco said:
Install this cab and it will perfectly display Chinese. It is suitable for almost any WM5,6,6.1 rom :http://www.51spsoft.com/DownInfoEn/info26059.html
Or direct download link: http://www.51spsoft.com/Download.asp?ID=26760
Click to expand...
Click to collapse
Thank you for the suggestion. I just installed it on my official ATT ROM (WM 6.1). It showed installation successfull. It also said it may not display properly b/c it's designed for a previous version of Windows Mobile.
Anyway, then I visited mitbbs.com and www.sina.com.cn as a test (using Internet Explorer). Both did not show Chinese. I also tried changing encoding to Unicode UTF-8 and it didn't work either. under system settings, I looked at regional settings and didn't find anything Chinese.
Is there any configuration that needs to be done? Do you happen to know what ROM floating in this forum for WM6.1 can indeed incorporate this O2 Chinese support?
Thanks again

ctrc said:
Thank you for the suggestion. I just installed it on my official ATT ROM (WM 6.1). It showed installation successfull. It also said it may not display properly b/c it's designed for a previous version of Windows Mobile.
Anyway, then I visited mitbbs.com and www.sina.com.cn as a test (using Internet Explorer). Both did not show Chinese. I also tried changing encoding to Unicode UTF-8 and it didn't work either. under system settings, I looked at regional settings and didn't find anything Chinese.
Is there any configuration that needs to be done? Do you happen to know what ROM floating in this forum for WM6.1 can indeed incorporate this O2 Chinese support?
Thanks again
Click to expand...
Click to collapse
For regional setting, check the size of your wince.nls make sure it's > 1mb in size (typical English only is only 300 - 400k in size). But if you already planning to change yr rom, I highly recommand your try my rom. It's pre-configure for Tradition Chinese (HK, mostly), but will work on simplified chinese as well.

jackleung said:
For regional setting, check the size of your wince.nls make sure it's > 1mb in size (typical English only is only 300 - 400k in size). But if you already planning to change yr rom, I highly recommand your try my rom. It's pre-configure for Tradition Chinese (HK, mostly), but will work on simplified chinese as well.
Click to expand...
Click to collapse
I'm downloading your ROM, will try. Thanks for all the work!
just curious, where can I find wince.nls? I can't find any search function for the File Explorer on Tilt.

This is what I use to read Chinese website
http://forum.xda-developers.com/attachment.php?attachmentid=37342&d=1176792242
This is what I use to type Chinese
http://www.a4user.com/\A4_down_sip.asp
It doesnt support chinese hand writing input though. If you know of an SIP that supports hand writing input please post here

ctrc said:
I'm downloading your ROM, will try. Thanks for all the work!
just curious, where can I find wince.nls? I can't find any search function for the File Explorer on Tilt.
Click to expand...
Click to collapse
It's hidden file under \Windows. Therefore, must use "show all file" in order to display it.
cproaudio, all listed below support Chinese writing
http://www.studiokuma.com/wm/?section=support
CE star
Monster

I tried installing CE-Star 2.8 Chinese support on the shipped ROM and it worked.
I then flashed the ROM to Jack's cooked ROM and it works great now. Thank you, Jack.
Thank everyone. This forum is great.

Instructions to migrate ATT WM6.1 to Jack 2.6 confirmation
Dear All:
I just got the same phone as" CTRC above" but to ensure that I dont make any mistake on updating ROM using Jack's V2.6 from ATT Tilt WM6.1:
ROM version: 3.57.502.2 WWE (since shipped I didn't flash the ROM)
ROM date: 07/17/08
Radio version: 1.65.21.18
Protocol version: 25.88.40.05H
I read all of the above . However, to ensure that I dont run into wall,
Can someone post the step by step instructions including any potential "landmine" on how to migrate from the
ATT ROM above to Jack 2.6 ROM including the instructions if I need to install
those pre-requisites (Soft and Hard SPL ?)and proper Radio ?
Many Thx

mmtea said:
Dear All:
I just got the same phone as" CTRC above" but to ensure that I dont make any mistake on updating ROM using Jack's V2.6 from ATT Tilt WM6.1:
ROM version: 3.57.502.2 WWE (since shipped I didn't flash the ROM)
ROM date: 07/17/08
Radio version: 1.65.21.18
Protocol version: 25.88.40.05H
I read all of the above . However, to ensure that I dont run into wall,
Can someone post the step by step instructions including any potential "landmine" on how to migrate from the
ATT ROM above to Jack 2.6 ROM including the instructions if I need to install
those pre-requisites (Soft and Hard SPL ?)and proper Radio ?
Many Thx
Click to expand...
Click to collapse
Wiki is your good friend here: http://wiki.xda-developers.com/index.php?pagename=KaiserIntroductionToROM_Flashing

Hi Jack:
I had already unlock the ATT tilt using unlock code ...Do I still need to run step one below?
1. CID-unlock your device by following the instructions at pof's HTC Kaiser Hard-SPL v1 - CID Unlock & Flash any ROM to your device (4 free)-thread
BTW, I did get the "white screen" on this phone ... and follow the instructions to :
- 1a. download the 5 attached files
1b. pull out the battery, REMOVE SIM and SD CARDS !! and reinsert battery (this step *is* important)
1c. connect your PC to phone with a USB cable
2. copy JumpSPL1.56-KAIS.exe to your device and run it (make sure the USB cable is still connected). If you still get a white screen then reset your device and now try JumpSPL1.93-KAIS.exe ...
The step (2) above , copy the JumpSPL1.56-KAIS.exe to the device ...Pls advise which folder and how to run it after taking the SIM OUT ?
Thx

White Screen Issue
Hi Jack:
JumpSPL1.56-KAIS.exe to your device and run it (make sure the USB cable is still connected). If you still get a white screen then reset your device and now try JumpSPL1.93-KAIS.exe ...
Are these JumpSPL1.56 or JumpSPL1.93 run from PC or the terminal device itself ? How do I run these two ".exe" files in the device ?
Why am I getting White Screen and others devices dont get white screen ?
Thx

mmtea said:
The step (2) above , copy the JumpSPL1.56-KAIS.exe to the device ...Pls advise which folder and how to run it after taking the SIM OUT ?
Click to expand...
Click to collapse
Anywhere. I would copy it to the top level (\). Even if you took your sim out, you can close the phone page (which complaints about sim) by tapping the top right corner or the hardware red button (hang up). Then use "File Explorer", locate the exe files that you copied and click on it.

Hi Jack,
I am new to the Tilt. How do I get to "File Explorer" ? I dont see it on the menu when I open either the "setting" or "programs" ?
BTW, when I run the JumpSPL1.56-KAIS.exe, do I also need to run the Kaiser Hard-SPL v1 again ? what's the right sequence ?
Thx

RESET
Hi Jack:
Is the rest pwer+camera+ "navigation" at the same time to get Tri-colour ?
if NOT, which three at the same time can "reset" ?
Thx

[REF] Easiest way to SIM unlock your Elf/Elfin even if it's "MCC+MNC = None"

[REF] Easiest way to SIM unlock your Elf/Elfin even if it's "MCC+MNC = None"
First of all, sorry for my bad english...
Here goes the best way I found to unlock all Elf/Elfin, even those with the deadly "MCC+MNC=None" (wich is my elfin).
I saw some people say that when flashed with "Elf_Elfin_2.11.0.0_MFG_ModuleBuild" the phone it's not SIM locked anymore, but after reflashing with another rom it got locked again.
I tried that myself and it was true, I flashed "Elf_Elfin_2.11.0.0_MFG_ModuleBuild", then flashed other rom (with only the OS part) over it and bam, was locked again.
So the locking part should be in the OS. After looking over the system files, I found two files (SIMLock.exe and SIMLock.exe.0416.MUI [my OS was BR Portuguese]) and thought "here is the locking problem" (because "Elf_Elfin_2.11.0.0_MFG_ModuleBuild" don't have those files in the system folder!). Then I deleted those files and it wasn't SIM locked anymore... but it didn't find any networks.
So I serached a little more (google is your best friend in times like this) an discovered that the file rilgsm.dll is responsible for the network... It starts and calls SIMLock.exe, if SIMLock.exe returns a valid SIMcard, then rilgsm.dll starts the network service.
So that's the diference between "Elf_Elfin_2.11.0.0_MFG_ModuleBuild" and the other roms, its rilgsm.dll don't have the part that calls to SIMLock.exe, it just starts the network service based on the SIM card you have inserted.
So I just took that dll from that test rom and copied over another rom and it worked like a charm!
Enough talking, here's what you gotta do to SIM unlock your Elf/Elfin (no matter what rom you have):
You will need this file (unlocked "rilgsm.dll")
- Extract the file you just downloaded to a temporary folder.
- Turn on your mobile WITHOUT the SIM Card.
- Connect your Elf to your PC (activesync).
- Find the files "rilgsm.dll", "SIMLock.exe" and "SIMLock.exe.0***.MUI" (the *** depends on the language of your OS) on the windows folder of your mobile and make a bakup of them (in case you want to SIM lock it again).
- Copy the extracted "rilgsm.dll" over the one on the windows folder (say yes when it asks to replace the file).
- Delete both "SIMLock.exe" and "SIMLock.exe.0***.MUI".
- Turn off your mobile.
- Insert any SIM Card (that didn't work before) and turn your mobile on again and enjoy your newly unlocked ELFin!
If you intend to flash some other rom, just copy the dll again and it's ready to go.
Hope this helps.

Great find!!!
For Rogers users who are using the regular stock ROM, it is probably a good idea for them to use the regular free unlocking method because rilgsm.dll is responsible for Rogers Name Display. Other than that, I hope it works well for everyone else!!!
Anyone else tried this?

yes, I have, did not work. phone does not have simlock.exe or simlock.exe.xxxx.mui on windows folder, and just replacing rilgsm.dll does not affect carrier lock. when inserting sim card from other operators, it still asks for subsidy code.
Tested phone is:
ELF010050
BSTAR502
IPL: 2.24.0002
SPL: 2.26.0000pof
99HEH077-00
Operator Tim Brazil
ps.: I tried as well when phone was with stock rom, and was the same thing.
br

Good idea!!
I haven't tried your procedure but I also know that OS contained in "unbricker rom" (test only rom) do SIM unlocking, so I believe this will work . I will try it soon in my free time. Thanks!!!

I'll try to reflash my elfin tomorrow and do some other tests with it, to see if there are any problems with some specific roms.
My elfin:
ELF010050
BSTAR502
IPL 2.24.0002
SPL 2.24.0000
99HEH077-00
Claro Brazil
I'll post something more tomorrow.
Sorry for the lack of testing before posting (newbie yet).

i would feel better by patching or replacing the simlock.exe file instead of changing the dll.

zerostuff, why don't you add a poll to this thread to see if it works for most people?

Thank you for the idea dsixda.
I sent the .exes and .dlls to a friend of mine and asked asked him if he can find the locking part in those files (because i'm just a normal user and don't know anything about hex editing and stuf).
And I'm still testing some roms on my elfin to see if I can find a working and a non-working way to unlock it (so far, all the roms are working).

thinking of buying a htc elf
hi all im thinking of buying a htc elf but its locked to orange is it easy to unlock and get rid of the orange start up logo .
would you give me step by step guide on how to do it ?
thanks in advance

As you can see, some is easy to unlock others no solution yet...

@ zerostuff
elfin ELF010050 BSTAR502 from Vivo Brazil, had the simlock.exe and simlock0416.exe.mui . I replaced those files with and small clock app, and replaced rilgsm.dll , and did not worked (error 'unavailable file', and then hang) . So, I deleted the simlock.* , and phone got into menu, but no signal.
indeed, this is a way to go, but still need improvements.
@ chester-lad-2009
search board, there are many topics regarding that. this topic is not for that discussion.
br

zerostuff said:
- Delete both "SIMLock.exe" and "SIMLock.exe.0***.MUI".
Click to expand...
Click to collapse
hi, i use onyx 4.43 rom and when i try to delete a message tell me "could not delete. i try in windows and in my elfin too using total comander and sktools. how can delete this files?

I've try on my HTC Touch 3450 (PT) substitute the file and i can't! And i can't found these 2 files...

Using Total Commander
First we move the rilgsm.dll to windows folder, then delete the two files SIMLock.exe & SIMLock.exe.0***.mui, and ignore the Warning! Could not delete 1 file(s)...
Then reboot the ELFin and it´s done....loooooool... No need to put codes...
Just doing those steps, it´s done the SIM_Unlock
Strange??? i don´t know, but work´s
Note: Tested with One PT ELF and One ELFin BRS, worked fine!!!

Great post works like a charm!
i needed to use another explorer since my original rom dont let me move or copy windows folder file!
i used WinFileCE.exe to do the trick , but it worked !
1 more thing , is it possible to cook a rom with this files inside!? because if i hard reset the phone it relocks it self by this method!!

These two files they realy removed???

I cant' remove this two files because the cellphone is using them, how can i stop process's on Windows Mobile?

Using TC I was able to copy rilgsm.dll to \Windows. But simlock.* are a different story and I wasn't able to delete them.
Anyway, using this version of rilgsm causes the phone connection to die: it cannot be set on from Comm Manager. And then after some time, Comm Manager throws two or three errors.
It's an HTC Touch from Claro, Argentina. The ROM is http://forum.xda-developers.com/showthread.php?t=442391
Code:
Touch version : Elfin
Device ID : ELF010150
CID : BSTAR301
IPL : 2.24.0002
SPL : 3.07.cmonex
ROM Version : 3.07.720.03
ExtROM Version : None
Operator Version: None
AKU Version : 1.2.7
Page Pool : 12 MB
RAM Size : 128 MB
ROM Size : 256 MB
Model No. : ELF0100
Part Number : 99HEH129-00
MCC+MNC : Not found
Any information you guys want or some tests that could be run in the device, just tell me.
Cheers.

Not worked Efl 3450 ( 64/128)
The idea was great, but not worked with Efl 3450 ( 64/128)...
My device was patched (IPL 2.27/SPL 2.28 cmonex) and Rom ELVES ROM V5.0 - CE OS 5.2.2021.
No files found in windows dir "SIMLock.exe" and "SIMLock.exe.0***.MUI", so i just copy this file (unlocked "rilgsm.dll") to windows dir and i did a soft reset.
Result: deviced hanged.. new soft reset: boot ok, but no radio ( even trying to turning on manually), just wi-fi working..(nice to make calls from skype )
I don't have any clues about how to bypass simlock..
Any help will be appreciate.
Cheers

RILGSM.dll is not locked/unlocked
The thing is, that file controls GSM<-->PDA radio functions. As you took RILGSM from a "test" rom (is unlocked one)
When u sim unlock a device, it doesnt overwrite RILGSM with "unlocked" properties
The solution will be rewrite a RILGSM.dll file, and write a SIMLOCK.exe file with spoof properties to make think device is unlocked

Can't downgrade the rom

Hi!
I recently installed the wm6.5 cotulla's rom for 64mb devices in my htc magician. But after give it a try, I want to downgrade to the original rom. But, when I try to downgrade to this rom "OS 1.12.03 / ExtROM 1.12.159 / Radio 1.12" (The last official ROM in spanish) I cant do this because it says: Error of ID of country.
Someone knows how to fix that?

larstnt said:
Hi!
I recently installed the wm6.5 cotulla's rom for 64mb devices in my htc magician. But after give it a try, I want to downgrade to the original rom. But, when I try to downgrade to this rom "OS 1.12.03 / ExtROM 1.12.159 / Radio 1.12" (The last official ROM in spanish) I cant do this because it says: Error of ID of country.
Someone knows how to fix that?
Click to expand...
Click to collapse
Must replace ROMUpgradeUt.exe to MaUpgradeUt_noID.exe

This same problem
I have got this same problem. *.exe file was replaced.

don't worry worry i'll help you.
but before we start, can you still go to the boatloader.? if you do then here we go.
extract the files inside your spanish rom.
it its the original rom, you should have these files:
check link: h--p://pdamobiz.com/forum/uploads/image2/CEZFF_1.gif
then, open or run "RomUpdateUT.exe"
don't press next yet.!
download these file h--p://files.pdamobiz.com/ROMs/XDA/Magician/MaUpgradeUt_noID.exe and save it on where you extracted your original rom, it should look like this:
check link: h--p://pdamobiz.com/forum/uploads/image2/5EFAZ_2.gif
now open and run MaUpgradeUt_noID.exe
now you can press the next button and follow the instruction properly.
h--p://pdamobiz.com/forum/uploads/image2/E7661_u02.jpg
h--p://pdamobiz.com/forum/uploads/image2/52E61_u03.jpg
h--p://pdamobiz.com/forum/uploads/image2/2FE8E_u04.jpg
h--p://pdamobiz.com/forum/uploads/image2/Z47E6_u05.jp
h--p://pdamobiz.com/forum/uploads/image2/84D35_u08.jpg
by the way make sure that you're battery has enough charge, and also check your rom if its not corrupted.
credits to:
ruchonburi of pdamobiz.com
i've done this when i tried Cotulla's latest rom, and it prove to me that downgrading was easy as long as you have the original rom.
i hope it helps.

[Q] RSPL/HSPL for HTC 7 pro T7576, please ?

hi everyone
my english is not very good
I need your advice, I have a phone HTC 7 pro (T7576), Could you tell me the "[DFT][Updated!#3] HSPL / RSPL for HTC WP7 First Generation" supports my phone ? because I don't see my phone's name in "supports WP7F devices" but in "List of supported MIDs" has my phone's MIDs
here is my phone's information
Name: "HTC 7 pro T7576"
software windows: windows phone 7
Os version: 7.0.7403.0
firmware version: 2250.10.12401.207
hardware version: 0002
bootloader version: 1.24.2250.0
chip SOC: 2.2.5.0
"PC92100" SS-BC(4k)
SPL-1.24.2250.0 (117856)
microP(LED) 0x06
SD SANDISK 7580M
partition info: v211v413
And Could you suggest me the mango custom rom which is suitable with my phone ?
thank you very much

If you MID is supported, then you are fine. The post incorrectly lists the "Pro 7" instead of the "7 Pro" but that's just a minor mistake. Your phone is known internally to HTC as the "Gold" and many things on XDA-Devs use these internal names. You'll notice that the Gold is indeed supported, uncluding your MID.
The best place to find custom ROMs is on the section of the forum devoted to your device. There are many characteristics of each ROM; you'll need to decide which to use for yourself. Differences include things like the bundled apps, the list of languages, the OS version (why get Mango when you can get Tango?), the set of themes, and other things.

You can try install HSPL, I think so DFT supported your device. You read this:
If your current SPL version doesn't present in the list, you can choose nearest version,
BUT ONLY IF IT HAS SAME FIRST NUMBER!!
Example: You have 4.XX on the device. Do NOT choose 1.XX 2.XX 3.XX.
Click to expand...
Click to collapse
You can try because you have SPL version 1.XX - HSPL supported SPL 1.22 for HTC 7 Pro.