This is an alternative method for SuperCID the Tornado smartphone
Firs of all you need to download the uitils:
http://rapidshare.com/files/132988194/Unlock_SuperCID_Your_SPV_C500_550_600.rar.html
STEPS:
1.Extract files.
2.Now establish a connection between the phone and ActiveSync.
3.From the Decertificare folder copy the file Allow_decert.cab to the root directory of the phone.
4.Install Allow_decert.cab into the phone and reboot it.
5.Establish the connection between phone and ActiveSync then, from the same folder run Semi_decert.exe press Remove Lock button, if the phone was unlocked successfully a message box will appear and ask you to reboot again.
6.Establish the connection between phone and ActiveSync again, then from the Decertificare folder copy the file Full_Decert.cab to the root directory of the phone(Do not install it,just copy it).
7.Finally from the main folder run Lokiwis.bat you will see a msdos window with 4 options:
U-Unlock
L-Lock
C-CID Unlock(SuperCID)
Q-Quit
Select option C and press enter, after this the phone will reboot an your phone will be SuperCID.
To be more sure that your phone is SuperCID and using TeraTermPro util follow next steps:
1.Disable usb connection of the ActiveSync(Uncheck allow usb connections).
2.Unplug usb cable.
3.Turn your phone off.
4.Press the camera button and plug the usb cable(You'll see thw white screen and seconds later the three color screen.
5.Run TeraTermPro.
6.Select Serial and in port: USB then ok
7.Type: info 2
and if in the end of the list you see supercid htc or something like that it's done!!
Close TeraTermPro and just run any ROM you want and voilaa!!
I recomend you to perform a format BINFS before install any ROM
Hope this be useful for you all.
See ya from Mexico!
Hey thanks!
You're welcome! and I hope you'd got SuperCID your phone!!!
Great!!!!
Finally!! all these days without a solution to unlock these phones, then you came my friend and made my day.
Best regards from Colombia
Luis M
Data Crashes.
Followed the procedure precisely and at the end I got:
"Data crashes. Please contact your service provider."
I ran the TeraTerm to check what is the status of info 2:
GetDeviceInfo=0x00000002
GetDeviceCID: Error - InitDecoder
HTCS ´í•6HTCE
Right now I have device with bad CID block. I keep the original backup from lokiwiz, but I don't know how to write it back.
There is a thread for Wizard started and it looks like there is hope, just I need a tool to write the CID backup block back to the device.
Thanks.
SuperCID unsuccessful, Please help!
First SPVServices cannot connect to the remote site.
Then, I tried the alternative using Unlock_SuperCID_Your_SPV_C500_550_600.rar. Followed every step exactly. When I run Lokiwiz.bat, here is the output from the MSDOS window:
....
--------------------
U. Unlock
L. Lock
C. CID Unlock (SuperCID)
Q. Quit
--------------------
Type the letter and press Enter: C
CID unlocking mobile... DO NOT DISCONNECT UNTIL THE PHONE REBOOTS!
ERROR: Unable to open WinCE file '\windows' - Returned by WSARecv or WSARecvFrom
to indicate the remote party has initiated a graceful shutdown sequence.
opening: lock_backup.bin: No such file or directory
This exe file was created with the evaluation version of Perl2Exe.
For more information visit http://www.indigostar.com
(The full version does not display this message with a 2 second delay.)
...
PLease, please help! Thank you so much!!!
/dan
TeraTermPro
Hi Bro, you now where i can find TeraTermPro???
if you can upload shotware, it´s better, thank you bro
Thanks !!
Brother thank you very much
to day i can unlock my first SPV C600 with your help
if you need anything from me, it´s done.
msn/email: [email protected]
pdt. afther you have SuperCid, and your phone reboot
run again lokiwis.bat and write U and Press Enter
afther you phone reboot, insert a simcard from
your company and enjoy it
download here teratermpro
unlockboxthis said:
Hi Bro, you now where i can find TeraTermPro???
if you can upload shotware, it´s better, thank you bro
Click to expand...
Click to collapse
Hey sorry for the delay but I've been kind of busy, TeraTermPro can be downloaded from here:
http://rapidshare.com/files/134350178/TeraTermPro.zip.html
hey I saw your post, sorry for the delay mhhh does your phone compatible?? I mean I tested with SDA (US) Tornado and I got success, I think you should try once again but now place files in different root.
to anewbie
anewbie said:
First SPVServices cannot connect to the remote site.
Then, I tried the alternative using Unlock_SuperCID_Your_SPV_C500_550_600.rar. Followed every step exactly. When I run Lokiwiz.bat, here is the output from the MSDOS window:
....
--------------------
U. Unlock
L. Lock
C. CID Unlock (SuperCID)
Q. Quit
--------------------
Type the letter and press Enter: C
CID unlocking mobile... DO NOT DISCONNECT UNTIL THE PHONE REBOOTS!
ERROR: Unable to open WinCE file '\windows' - Returned by WSARecv or WSARecvFrom
to indicate the remote party has initiated a graceful shutdown sequence.
opening: lock_backup.bin: No such file or directory
This exe file was created with the evaluation version of Perl2Exe.
For more information visit http://www.indigostar.com
(The full version does not display this message with a 2 second delay.)
...
PLease, please help! Thank you so much!!!
/dan
Click to expand...
Click to collapse
hey I saw your post, sorry for the delay mhhh does your phone compatible?? I mean I tested with SDA (US) Tornado and I got success, I think you should try once again but now place files in different root.
Maybe
d1saster said:
Followed the procedure precisely and at the end I got:
"Data crashes. Please contact your service provider."
I ran the TeraTerm to check what is the status of info 2:
GetDeviceInfo=0x00000002
GetDeviceCID: Error - InitDecoder
HTCS ´í•6HTCE
Right now I have device with bad CID block. I keep the original backup from lokiwiz, but I don't know how to write it back.
There is a thread for Wizard started and it looks like there is hope, just I need a tool to write the CID backup block back to the device.
Thanks.
Click to expand...
Click to collapse
Hey bro why you dont try once again without the simcard??? or first with lokiwis try to unlock the phone and then try again, that may fix the problem
i also followed all the steps and when it reboots finally i get a message saying "data crashes contact oraanges services"
pls help
I vote for sticky!
Hi I have looked all over here and can't work out how to perform the format on the BINFS can someone help me here?
Please help
This tool broke my SP5m.
On startup im receiving a ''Data crash'' error that says ''go to service center''
I cant open my phone.
I reflashed offical i-mate_SP5m_WWE_2.6.331.2.exe rom and it comes again.
Please help.
tera term is showing this when i type ''info 2''
Code:
info 2
GetDeviceInfo=0x00000002
GetDeviceCID: Error - InitDecoder
HTCS ´í•6HTCE
Cmd>
How can i fix that ???
chaqueun said:
Hey bro why you dont try once again without the simcard??? or first with lokiwis try to unlock the phone and then try again, that may fix the problem
Click to expand...
Click to collapse
it dont works man.My phone is unusable with simcard now
Please help?
I tried unlock,cidunlock,lock but there is no difference ((
Hey bro why you dont try once again without the simcard??? or first with lokiwis try to unlock the phone and then try again, that may fix the problem
Click to expand...
Click to collapse
I tried few more times with and without a SIM card, no luck. If somebody doesn't know the lockwiz is designed for HTC Wizard, not for Tornado. Somebody said that ONLY CID unlock would work, but apparently not for all Tornados.
GetDeviceCID: Error - InitDecoder
HTCS ´í•6HTCE
Click to expand...
Click to collapse
Congrats, now you have basic PDA without Phone function. Remove the SIM card and you can use the device at least to back up all your contacts. The problem now is that you have bad COD block, which has the Certificate and the Radio information on it. I had backup of the CID block and tried to reflash it back to the device but the problem was still there. So I went to imei-check.co.uk, paid $40 and they fixed it with the provided software tool and unlock key file. It seems that Tornado has lack of developers, who can provide sophisticated tool which can backup and restore all memory blocks without the end user knowing the hex address of the particular memory block.
Successfully unlocked, thanks
(Qtek 8310)
This is a risky method for many tornados.Please use only spvservices.Dont use this wizard tool.And it can crash wizard too.
it can remove some keys from your sim block or write wrong keys and your phone gives data crashes error when your sim card is in.So you cant use your simcart.
Only the solution for tornado is buying a full unlock flash file that created specially for your imei.I bought it and my phone is working now
On wizard (not tornado) there is a project to rebuild keys without buying imi-check.com sim flash file:
http://forum.xda-developers.com/showthread.php?t=307558
Related
Made a huge error.....didnt go through forums and read instructions before trying to Flash a German T-Mobile MDA Compact to a English ROM....
The device is completely dead....
Followed all the steps required to get it back up...It is refusing to do so though....
Used this thread:
http://forum.xda-developers.com/viewtopic.php?t=19500
One thing to note is that I am not using the AC charger, am using the USB cable to charge the phone.
Can someone please helpme...
Haven't got past the bootloader mode...
If you followed the instructions from the other thread, it should have started flashing.
Some things to check on:
1) Did you do a full d2s before you attempted the upgrade? It's always good to have something to fall back on.
2) If you can get to a bootloader screen, all is definitely not lost.
3) Sometimes, it takes 4 or 5 minutes for the "Press to flash" comes up on the screen so be patient with that.
4) Make sure you did exactly a 416 byte copy from the original rom file in to the new flash file.
5) You can only write an nb1 file from the pc AFTER it has been created from the pocket pc. If the SD card has been pc formatted, the nb1 file will write to it but the pocket pc won't recognize it and will just sit there at the bootloader screen.
HTH
I think I fired the MDA
Well I did not create the nbf file from the ppc, downloaded it from the the forum FTP. I do not have the backup of the nbf file. As I mentioned I did not read the forums before trying the update.
I just downloaded the T-Mobile ROM update and tried installing it. Obivousioly it didn't work, Game the dreaded the 112 error in the 3rd step.
Am not even getting the bootlader screen now..
Any ideas on how I can get this device up and running.?...
ok, need some clarification here. "What" are you trying to load (nbf files or nb1 files) and how are you trying to load them (SD flash or the standard USB based upgrade)?
Easy enough to check to see if your device can still get to bootload mode....hold the camera and power switches in at the same time and hit soft reset with your stylus. After letting go of those and you see either "Serial" or "USB" at the top of the screen, you should still be able to recover from this.
Tried with the nb1 files not nbf (sorry abt teh error)..
The bootloader screen was showing up ...unitll I tried the T-Mobile MDAcompact_vers11201
After the 112 error while updating...the device now refusing to get to the bootloader mode.
Have I fried the device and made it unusable....?
hey just got back the bootloader screen...
Take the SD card out, disconnect the USB and tell me what happens when you hold the power and camera buttons in at the same time, then hit the soft reset.
Also, has the unit been charged recently?
Its showing Serial v1.00...after the reset.
Its been on the USB chatge all along.....
Great. If you get Serial at the top, this can be recovered.
If you want a good T-Mobile 1.12 rom file, go here and use this one:
ftp://ftp.xda-developers.com/Uploads/Magician/tmobile-uk_wwe_ROM_1.12.00(thereapermanl).rar
Unpack it and follow all the procedures about copying the 416 bytes, rewriting the file, etc. from the other thread. I have tested this rom file and it installs ok.
Thanks for the encouraging words...
Will it work even if I do not have a backup of the original ROM on my machine?....I only have the tmobile.nb1 file which I got from the XDA forums.
Lemme try using that and editing it.
Thanks a ton for your help.
You might be a little stuck for an nb1 flash if you don't have an original flash back up but don't fear. You can go here and get this WWE1.12 file and just do a USB type upgrade:
ftp://ftp.xda-developers.com/Magician/Shipped_ROMS/WWE_11200_128_11210_ship.exe
I know this one works too. It's ROM 1.12, Radio 1.12 and Ext_ROM 1.12. When you try to run the upgrade program though, it might give you a Country ID error. If so, use the attached upgrade program instead. If this one gives you a Country ID error again, close the program and just run it again. I've been down all these roads already.
Lemme get this right this time: I will be doing the following
1. Install the ROM as you have mentioned. With the country id hack if necessary
2. Hopefully by now the device would be alive. If so will take a backup of the ROM on the SD card
3. From then on follow the instruction given in the doc.
Hope I get it righ this time else Its going to be a long night for me.
Lemme know if I have to do anything else.
Either ROM will work fine for you. It just depends on whether or not you want I-Mate stuff on it or T-Mobile stuff on it.
Doing the USB upgrade will put the I-Mate ROM on but after that, it should be working and you can then do an SD backup, follow the SD flashing procedures and get the T-Mobile ROM on.
Good Luck!
The masupgrateut is throwing up a ruu.dll error?...you seen that one before?
What sort of error? Not found?
yup...
I extracted the ROM exe and found teh file...copied it to the windows folder..and ran the no id program...no error this time round but the update is still giving a COuntry ID error...
Been looking at various posts...specially this one...
http://forum.xda-developers.com/viewtopic.php?t=14973
Thinks thats gonna help?
ok...two things.....just run it again. The no ID program sometimes does that on the first time 'round so just run it again.
Second, stick this at the end of the RUU.conf file:
[CHECKCEID_TYPE]=1
ran the program multiple times...still getting the COuntry ID error...
Are you running this program? MaUpgradeUt_noID.exe
...with the change in the RUU.conf file?
I just noticed something....did you extract all the files to a single directory and just run it from there or did you just pull a few out?
ALL the files have to be in the same directory. This is also where you need to execute the installer program.
I have installed the new iMate rom to my T-Mobile SDA(US) and have the following observations.
Push Email is working well.
Screen fonts not as crisp as original T-Mobile.
I believe the OS is overall slower.
Don't see A2DP.
Camera and Video work well.
I'll keep testing and keep this thread updated.
Do you know where I can find instruction on how to backup my original T-Mo rom? I'd like to load the sp5m rom but I want to make sure I have a backup. Also, which filename did you use, there seem to be sever roms for sp5, sp5m and two versions for the sp5m at that!
-Kap
kaplanfx said:
Do you know where I can find instruction on how to backup my original T-Mo rom? I'd like to load the sp5m rom but I want to make sure I have a backup. Also, which filename did you use, there seem to be sever roms for sp5, sp5m and two versions for the sp5m at that!
-Kap
Click to expand...
Click to collapse
Here is what I recall, I'm by no means an expert.
To start, you will need a 64MB mini SD card minimum.
I had to application and SIM unlock the phone. You can find good info at http://wiki.spv-developers.com/index.php/Main_Page
Disable ActiveSync under File/Connection Settings by unselecting "Allow USB connections".
With the phone off, press and hold down the camera button while attaching the USB cable from your computer. This should bring up the 3 color bootloader screen on your phone.
Use mtty.exe on your computer and select USB to connect. After connecting type:
r2sd all
This should back up your original rom to the mini SD card. This action will COMPLETELY REFORMAT AND ERASE YOUR SD CARD. I'd suggest copying everything off of it to your HDD in ActiveSync.
This is where it gets gray for me. There is supposedly a way copy the image from the SD card to your PC and back using itsutils utilities called psdpread.exe and psdwrite.exe. You have to know or figure out the size of the image on the SD card and the instructions were not intuitive to me. At this point I am leaving the card out of my phone until I decide whether or not to stay with the iMate rom. I did confirm that I can use the card to reload the T-Mo rom. With the card in the phone, load up the bootloader as described above. When it first comes up, it will ask you press the volume slider to load from the card. I worked for me.
I get Vendor ID error
What was required to load the ROM on your T-Mobile US branded SDA? I keep getting a Vendor ID error ( I assume the same as the old country code error on the XDAs). My phone is application and sim unlocked.
Thanks.
Panabax
Re: I get Vendor ID error
Panabax said:
What was required to load the ROM on your T-Mobile US branded SDA? I keep getting a Vendor ID error ( I assume the same as the old country code error on the XDAs). My phone is application and sim unlocked.
Thanks.
Panabax
Click to expand...
Click to collapse
I had to use what I believe is referred to as the Super CID unlock. It is one of the options in the SPV-Services app I got from the URL referenced in the first post. I was very leary to use it because I couldn't find any documentation about how to revert back if desired. I haven't had any issues since I set it to "11111111". I only hope that it won't prevent me from using the official T-Mo AKU2 release when it comes out.
Thanks
Thanks. In the time between our posts, I came to the same conclusion. The upgrade is proceeding as I type.
Panabax
Hmm sounds like something I would like to try. Thanks for all the good info, I have a 256 MB sd card on the way from New Egg to use exclusively to back up my rom (didn't want to waste my 2gigger .
-Kap
artiemon said:
Use mtty.exe on your computer and select USB to connect. After connecting type:
r2sd all
Click to expand...
Click to collapse
Can you explain where to get mtty.exe and how its used?
Thanks
-Kap
kaplanfx said:
artiemon said:
Use mtty.exe on your computer and select USB to connect. After connecting type:
r2sd all
Click to expand...
Click to collapse
Can you explain where to get mtty.exe and how its used?
Thanks
-Kap
Click to expand...
Click to collapse
Here is where I got mtty.exe.
http://wiki.xda-developers.com/index.php?pagename=HimalayaHowtoCopyRom
The following thread has some info on backing up the rom. Scroll down to a post by Genesis3. He is referring to a different terminal emulator (terraterm), but it works the same as mtty. Both of these just open up a terminal session to your phone. Genesis3 is discussing a different platform, but you will get the idea.
http://forum.xda-developers.com/viewtopic.php?t=43399
thanks for the quick reply, im hoping to get the imate rom on my phone today.
-Kap
HI,
I downloaded the SPV-Services.zip. However, when I run it on my PC. It says
RAPI Init failed:RAPI init timeout
ROM editing tools will be unavailable
Anyone know what is the problem here?
Thanks
thx for your new ROM,
if i want to install chinese input software to input chinese word with
new rom, how can I?
thx again!
ronior said:
thx for your new ROM,
if i want to install chinese input software to input chinese word with
new rom, how can I?
thx again!
Click to expand...
Click to collapse
I dont think there is Chinese input program for Windows Mobile 5 SP.
thx for your rapid answer
but really has one!
your can find it almost in any chinese forum
ronior said:
thx for your rapid answer
but really has one!
your can find it almost in any chinese forum
Click to expand...
Click to collapse
Really?
well...then
did u application unlock the phone before installation? Just copy the cab file to your phone and run it....or use the setup if it has one
sixthday said:
HI,
I downloaded the SPV-Services.zip. However, when I run it on my PC. It says
RAPI Init failed:RAPI init timeout
ROM editing tools will be unavailable
Anyone know what is the problem here?
Thanks
Click to expand...
Click to collapse
You have to kill wcescomm.exe in the Windows Task Manager (ctl-alt-del keys brings it up), look for wcescomm.exe, stop the task. This will eliminate the error you are getting. Then Run the 'SPVServices.exe' file on your PC - it will communicate with your phone via activesync. Please note that this file connects to a remote server to do the unlocking calculations, so requires an internet connection. It's been reported that if you have IE7 (beta 2 in my case) installed, it might not work; I have IE7 B2 installed and all worked fine. On the SPVServices tool menu, click the CDI box, it will update your ID to 11111111 (now all is unlocked) then you can do the mtty.exe to backup up your ROM to a miniSD card. I have a word document I've written for myself that outlines some of these pieces and bits and parts I've read on various forums. Email me if you want the Word Doc file.
i have this problem:
r2sd all
***** user area size = 0x3CA0000 Bytes
R2SDBackup() - Download type = 6
usTotalBlock = 1 sizeof(SDCARD_SIGNATRUE_TABLE)=512
You didn't get the proper security level to download a specific image
Cmd>
can you help me?
ciselko said:
i have this problem:
r2sd all
***** user area size = 0x3CA0000 Bytes
R2SDBackup() - Download type = 6
usTotalBlock = 1 sizeof(SDCARD_SIGNATRUE_TABLE)=512
You didn't get the proper security level to download a specific image
Cmd>
can you help me?
Click to expand...
Click to collapse
I believe that message is displayed if you have not yet CID unlocked your phone. Did you use SPV Services to unlock it?
i have done these two procedures:
http://wiki.spv-developers.com/index.php/HTC_Application_Unlock_Guide
and
http://wiki.spv-developers.com/index.php/HTC_Smartphone_SIM_Unlock_Guide
than I tried mtty.exe but... :-(
have I forgot something?
There's an application called SPV-Services in one of the links above. It has an option for Super CID unlock.
Hi all,
I have to move back from a crystal v2. rom to the "original" rom, cause I had enough about the earphone jack problem, I want to use my warranty aqnd send it back to assistance
I have to reinstall the original italian jamin rom, I tried moving first to the NDIV rom and then to the italian rom : i got this
"ERROR (296): UPGRADE ONLY
This NBF file cannot be used for your PDA phone. Please get newer NBF filE"
Now I came back to the crystal v2
I think that first I have to cid unlock my jamin...
But the file I need, following the wiki link is broken, no more the file inside the archive....
Somone could " help " me ?? Maybe sending me a pvt ...
###################### THIS WAS A PREVIOUS MESSAGE ##############
I found the file by myself,
I started to cidunlocking but after the first process ( the seventh following the guide ) I am not able to connect anymore via usb my device to the laptop!!!!!
And NOW????? If I am not able to connect I cannot change the rom to a working one!!
Please HELP ME !!
###############################
It's becoming a Diary....
I solved by myself, the instructions for cid unlocking are not complete, if happens problem of connection between pc and ppc ( and I am sure they happen ) it is necessary to HARD reset the ppc, and remove and reinstall Activesync ... This is what I did , and it works ....
Thank you all
Do we know what commands does the bootloader accept through mtty?
If we find all of them and what each one does, couldn't we be able to revive a bricked device using mtty? <=The main idea belongs to htctouchp
Here is a list of possible commands(we will have to see which are real commands):
Code:
[SIZE="3"][B][U]Command[/U][/B] [B][U]"Usage"[/U][/B] [B][U]Parameters[/U][/B][/SIZE]
1.ESetDsbDBGMSGT
2.ClearDBGMSG
3.ReadExtROM
4.WLANReset
5.SDSelect
6.emapiCountryID
7.emapiINIT
8.emapiWlanMac
9.emapiPwrDwn
10.emapiRead
11.emapiTest
12.emapi
13.getdevinfo
14.ruustart
15.ruurun
16.progress
17.wdata
18.password
19.set
20.SetDebugMethod
21.checksum
22.ResetDevice
23.BTRouting
24.task "Unknown command"
25.lnbs
26.ls
wow!!! another great thread brother .i really hope that some expert can guide us here.
u have not mentioned the 'task' command here. i was also sure that this command didnt exist for elf/elfins. but today i used snoopypro while flashing a ROM and what i saw was 'task 28' when the ruu was just about to finish. after seeing that, i'm confused a bit
PS: this might be useful a bit:
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader
Very nice....
task command does not work for me...
you may want to add "lnbs"
htctouchp said:
wow!!! another great thread brother .i really hope that some expert can guide us here.
u have not mentioned the 'task' command here. i was also sure that this command didnt exist for elf/elfins. but today i used snoopypro while flashing a ROM and what i saw was 'task 28' when the ruu was just about to finish. after seeing that, i'm confused a bit
PS: this might be useful a bit:
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader
Click to expand...
Click to collapse
what is that snoopypro? u can actually see what is being flashed on the device?
hey great going guys. these threads are gonna be rocking helpful for everyone. spl thnx to htctouchp for initiating this idea
is this (http://forum.xda-developers.com/showthread.php?t=379318) something similar?
ababrekar said:
what is that snoopypro? u can actually see what is being flashed on the device?
hey great going guys. these threads are gonna be rocking helpful for everyone. spl thnx to htctouchp for initiating this idea
is this (http://forum.xda-developers.com/showthread.php?t=379318) something similar?
Click to expand...
Click to collapse
snoopy pro is just a usb port sniffer, it will record everything that passes a port. u cant actually see the flashing data, but u can make a log file out of it and after the flashing is over, u can analyze that log file. that post which u've given as reference, does the same thing. it records the session (usblog data) using snoopypro which later on u can open in hex editor. just try it out while flashing a ROM, and analyze the log later on. may be u can also find something useful
Hey guys!
Has anyone used the ls command?
Is it used like:
Code:
>ls
or
Code:
>ls c:\dump.nb
or
>ls \"Storage Card"\dump.nb
I tried the first one and waited,waited,waited...but (1)I got bored and (2)nothing was really downloaded to my pc so aborted You can see what mtty shows right below:
Code:
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
*Edit1:I'm asking for this command because I think it's a way to dump your rom(IPL,SPL,OS,etc.)
*Edit2:I found this nice tool, but it seems it doesn't work for my phone!Could anyone give it a try too and confirm?
Reading through an SPL.nbh file with a hex editor yielded the following known commands (as listed in the first post here):
SetDsbDBGMSGT
ClearDBGMSG
ReadExtROM
WLANReset
SDSelect
emapiCountryID
emapiInit
emapiWlanMac
emapiPwrDwn
emapiRead
emapiTest
emapi
getdevinfo
ruustart
ruurun
progress
wdata
password
set
SetDebugMethod
checksum
ResetDevice
BTRouting
lnbs
ls
Attached is a text file with a copy/paste of the results from issueing these commands in MTTY.
From what I can figure out you can load an NB or NBH file using lnbs or ls, BUT only ony a Super-CID or CID-unlocked device otherwise you get an error
Code:
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
So, bootloader commands issued through MTTY can be ery usefull for retrieving your Device ID and Model ID, and once CID unlocked you could load an image through MTTY instead of using RUUloader etc, but it looks tricky to figure out how to get things working for a CID-locked/bricked device.
Logic would indicate that somewhere in the NBH file would be a checksum relating to the Vendor-ID and/or Device-ID, having an NBH file where the ID and checksum don'y match would result in the 270 error - corrupt image (one could assume).
So, the big question in my mind at the moment is "How can one figure out where the checksum is in the NBH file". If we can figure out the address of where it resides, we could maybe use the checksum command to pull that info back? Then theoretically, to fix a bricked device all we would need to do would be hex-edit the NBH file to replace the vendor-ID and checksum with the correct one for the particular bricked device?
Thoughts/comments from any of our resident experts in USPL etc would be greatly appreciated!
Craig
good effort Craig
but how to revive an Elf(in) stuck in bootloader is still a mystery for most of us. lets hope for the best that someone out of us can unfold this mystery someday
Interesting!!!
Does anybody knows more comands Im searching for a hardreset via MTTY or a Cleaning DOC leaving behind the task 28 cuase in cmd> dont works... only in usb> i used it just once in a G3 HTCwizard then i cant do it anymore.
Maybe "format" command before the CMD>
kokotas said:
Do we know what commands does the bootloader accept through mtty?
If we find all of them and what each one does, couldn't we be able to revive a bricked device using mtty? <=The main idea belongs to htctouchp
Here is a list of possible commands(we will have to see which are real commands):
Code:
[SIZE="3"][B][U]Command[/U][/B] [B][U]"Usage"[/U][/B] [B][U]Parameters[/U][/B][/SIZE]
1.ESetDsbDBGMSGT
2.ClearDBGMSG
3.ReadExtROM
4.WLANReset
5.SDSelect
6.emapiCountryID
7.emapiINIT
8.emapiWlanMac
9.emapiPwrDwn
10.emapiRead
11.emapiTest
12.emapi
13.getdevinfo
14.ruustart
15.ruurun
16.progress
17.wdata
18.password
19.set
20.SetDebugMethod
21.checksum
22.ResetDevice
23.BTRouting
24.task "Unknown command"
25.lnbs
26.ls
Click to expand...
Click to collapse
Hi do you know a command for unlock the CID, because i tried to flash my phone P3300 an his broken, I can enter only in bootloader, every time when I try to intall a rom shows me error 300, so I think I didn't unlock the CID first time! Thank you and sorry for my english
Hi
You mention your device is P3300, this forum is about the Elf/in P3450 and P3452. No surprise it doesn't work ...
Use this link http://forum.xda-developers.com/forumdisplay.php?f=316
Hi,
I'm sorry about this post but there seems to be an anormous amount of information which doesn't make a lot of sense to me.
All I want to do is upgrade my palm treo 750 from win5.0 to 6.1.
I've downloaded the rom but it doesn't upgarade. So I need to figure out a way to flash this phone so it can be upgraded to any roms.
I have tried the Cheetahunlocker which doens't work. It gets stuck on 0% then times out.
Could someone please give me some basic instructions on the best way to do this on the treo.
I've done this on the TYTN2 whith no issues however on this phone, it seems to be a lot harder.
Thanks in advance.
Your device needs to be unlocked. You can do this by calling ATT and getting unlock code or by using Magic_Unlocker.
search
Also you will need to have the HardSPL installed which is Step 1 only of the CheetahUnlocker
I just did it yesterday so I know it works.
After you get the phone unlocked, name the ROM .nbh file CHEEIMG.nbh and then put it on the SD card
The start the CheetahUnlocker process as it enters the HardSPL process it will go ahead and run the CHEEIMG file and flash your ROM
(it works ! ) DON"T CHANGE THE RADIO !!!!
After doing that be sure and reclaim your ROM space - search web for Removing Ext ROM and do that process, hard reset and you are ready to go
Takes about 15 min!
jcrompton said:
After you get the phone unlocked, name the ROM .nbh file CHEEIMG.nbh and then put it on the SD card
Click to expand...
Click to collapse
Thanks for your info.
sigh..
The rom is an exe file...
I downloaded 7-zip, extracted the rom to a folder.
Looking through it, I am unable find the ROM.nbh file!
CHEEMING.nbh is already there..
What am I doing wrong?
Thanks.
artii said:
Thanks for your info.
sigh..
The rom is an exe file...
I downloaded 7-zip, extracted the rom to a folder.
Looking through it, I am unable find the ROM.nbh file!
CHEEMING.nbh is already there..
What am I doing wrong?
Thanks.
Click to expand...
Click to collapse
Sorry I forgot it was already named CHEEIMG.nbh -- just use it like I said above.
Copy it to the SD card, put the SD card in the device and after you have used Magic_Unlocker , connect via Active Sync and start the CheetahUnlocker process. This will start the three step CheetahUnlock process (really all you need is step one which will put the HardSPL in place) as that process fails the CHEEIMG file on your SD card will get flashed.
Hope this makes sense
Bottom line is that you will be doing an SD flash of the CHEEIMG.nbh file but it takes HardSPL for that to work. Step one of the CheetahUnlocker installs HardSPL (that will be all you need of that process)
remember!
THE SD FLASHING METHOD TAKES A REALLY LONG TIME. SO LONG YOU MIGHT THINK IT'S BROKEN. BUT IT'S NOT!!!!
caps with bold and red= great way to emphasize an important point.
Thanks for the info but I'm still running into trouble.
I copied the file to the SDcard but when running the cheetahunlocker, it give the same error at 0% ( error 206) something about the connection..
I notice that active sync turns off when the cheetah unlocker goes to the coloured screen.
Edit:
Also, should I be moving the CHEEIMG.nbh or just copying it to the SD card?
Thanks.
artii said:
Thaks for the info but I'm still running into trouble.
I copied the file to the SDcard but when running the cheetahunlocker, it give the same error at 0% ( error 206) something about the connection..
I notice that active sync turns off when the cheetah unlocker goes to to the coloured screen.
Click to expand...
Click to collapse
Did you run the MagicUnlocker first?
Is the CHEEIMG.nbh file in the root of your SD card? Try re-formatiing your SD card (FAT32 important!) and then putting the CHEEIMG.nbh file in place on the root of the SD card.
After starting the CheetahUnlocker the TriColor screen should come on and then it should go to a standard White boot scan. It will ask if you want to flash and you will be asked to confirm by pushing the Power button.
If you can ever get Step One to complete on teh Cheetah Unlocker you should be able to confirm that the HardSPL is installed by turing off Today screen (Red, end button) , then hold the left side button while then pushing the reset button. You will get a tricolor screen that lists your SPL version. If it is HardSPL on an unlocked device and there is a CHEEIMG.nbh file on an inserted SD card it will then automatically go to a White boot screen .....
If any of this sounds foreign to you then you need to familiarize yourself in the Wiki re SD flashing
PS do you have the NetFramework 2.0 installed on your PC? When you start the CheetahUnlocker are you getting the Treo device confirmation to install the 2 boot exe files that let the Treo go to the boot screen (you have to answer yes to both of these) - are you making it that far?
Yes I ran the unlocker which worked fine.
I formatted the SD card, copied the CHEEMING.NBH to it so it's the only file there.
No I run the CheetahUnlocker.exe , yes to disclaimer , then STEP 1 - I click FLASH SPL, then next, next etc.. I hit Update - next - next then the phone msg comes up asking if I want to run jumpSPL.exe - I hit yes and it goes to the tri colour screen, the active sync dissapears, the screen on the pc stays at 0% and then I get the error 260: Connection, check cable etc..
How is it suppoed to maintain a connection when Active sync turns off?
I did check and framework2.0 is present.
Thanks.
artii said:
Yes I ran the unlocker which worked fine.
I formatted the SD card, copied the CHEEMING.NBH to it so it's the only file there.
No I run the CheetahUnlocker.exe , yes to disclaimer , then STEP 1 - I click FLASH SPL, then next, next etc.. I hit Update - next - next then the phone msg comes up asking if I want to run jumpSPL.exe - I hit yes and it goes to the tri colour screen, the active sync dissapears, the screen on the pc stays at 0% and then I get the error 260: Connection, check cable etc..
How is it suppoed to maintain a connection when Active sync turns off?
I did check and framework2.0 is present.
Thanks.
Click to expand...
Click to collapse
I'm not sure exactly what is happening in your case but I do know that once a device of any kind enters the bootloader - Active Sync dies - AS is part of the OS and that no longer exists after the bootloader starts, I.e. Windows Mobile isn't really running any longer. the AS connection just gets it started.
I'm not too sure either.
I've unlocked the phone which worked fine.
When I run the cheetahunlocker, it doensn't get past the first step.
Should I be running Hardspl first?
What rom works best with the Treo 750? Link please!!!
What rom are you wanting to use? I have Treo750_WM6.1_WWE_Lite, looking for a more stable rom. Please list some or link them.
I tried both roms
the lite one and the normal one. I must say that the normal one is more stable - with the lite I had to do a reset at least one per day. with the normal version I did not do a reset at all...
Hi, did you resolve this CONNECTION issue? I'm having exactly the same problem.
Anyone?
hey everyone... i have a problem similar to these i think. I'll explain
i've done the magic_unlocker and i can do the 1st step of the cheetahunlocker. treo reset automatically and when i try to flash the rom the trilinear screen doesn't change to the blue screen which is the screen of the rom flash
anybody now why?
i have cracked my head the hole day and a still can't do it :S
artii said:
Yes I ran the unlocker which worked fine.
I formatted the SD card, copied the CHEEMING.NBH to it so it's the only file there.
No I run the CheetahUnlocker.exe , yes to disclaimer , then STEP 1 - I click FLASH SPL, then next, next etc.. I hit Update - next - next then the phone msg comes up asking if I want to run jumpSPL.exe - I hit yes and it goes to the tri colour screen, the active sync dissapears, the screen on the pc stays at 0% and then I get the error 260: Connection, check cable etc..
How is it suppoed to maintain a connection when Active sync turns off?
I did check and framework2.0 is present.
Thanks.
Click to expand...
Click to collapse
If it goes into the bootloader then you should be good to go. Both 750s i unlocked did this. However, if done correctly, the phone should go to a light blue screen where you will press the power button and flashing should begin.
na1kkkk said:
hey everyone... i have a problem similar to these i think. I'll explain
i've done the magic_unlocker and i can do the 1st step of the cheetahunlocker. treo reset automatically and when i try to flash the rom the trilinear screen doesn't change to the blue screen which is the screen of the rom flash
anybody now why?
i have cracked my head the hole day and a still can't do it :S
Click to expand...
Click to collapse
Are you doing the SD method or Desktop? DO the SD method and it should begin flashing right away after the 1st step of cheetahunlocker.