Related
This is what I get
Cmd>rtask b
Enter Radio Image
POWER OFF PMIC VREG_USB : SUCCESS!
C VREG_USB : SUCCESS!
Then cannot input at commands.
Surprisingly, my PC identifies two hardware attached and tries to install the driver..But it cannot find driver for "Data Layer".
I think POF only can throw some light on this..
The same situation for me, do you have Vista installed also ??
May 19th, 2008
With my new and revolutionary tool "FrankenKaiser" you can now finally jailbreak your locked to "Radio from Hell" Kaiser
======================================================
DISCLAIMER: This method involves erasing SPL & OS and requires correct data entry by the user. I will not take any responsibility for any malfunctions and or damages caused by using this method and software.
======================================================
Pay attention: this method will only work on a Kaiser device with radio version 1.65.17.10 (check your radio version in the boot splash screen!)
Note that you can not use copy & paste with MTTY, you must type the data exactly as written in the steps below. If in a step it is said to type a command always type them without the quotes.
Note that during the entire procedure you should uncheck "Allow usb connections" in Activesync.
I have tested the method on my own Kaiser, which was security locked and had original 1.65.17.10 installed. I'm on WinXP btw. GSLEON3 also succesfully unbricked his Kaiser with FrankenKaiser which had radio 1.64.08.21 installed. That should give you some confidence
So read very carefully and apply following instructions:
0) download and unzip the attached files on your PC in a single directory.
It contains all needed to jailbreak or unbrick your device, such as MTTY 1.42, my revolutionary FrankenKaiser program, screenshots to accompany this readme, the appropriate drivers to connect to the radio bootloader ("Drivers MotoQ"), and two softload SPLs (SPL1.56-KAIS-unbricker.nb and sspl-0.92-jumpspl-force-usb.nb)
1) Enter tricolor bootloader and make absolutely sure you have a HardSPL installed (either "olipof" or "1.1.JockyW"). If not you must first install a HardSPL.
2) Connect with MTTY (USB) and type "rtask a" followed by Enter, then type "radata 90000000 1" followed by enter (Note that this is not echoed to screen!!). In some rare cases after "radata 90000000 1" you may see "HTCSUN 0[=(HTCE". When that happens type "radata A0000000 2000"
Close MTTY and replug the USB cable. If you haven't installed them yet, your PC will now prompt you to install three drivers. Do a manual install of the MotoQ drivers. After the drivers are installed look them up in device manager and check which COM port is allocated to "Qualcomm diagnostics interface (COMxx)" => see screenshot "1. device manager search com.JPG" (on my PC it is COM4 but it may be anything else!).
If the driver is connected to COM10 or higher you should reallocate it to a COM port lower than COM10. Go in device manager and rightclick on "qualcomm diagnositcs interface 6000 (com18)". Enter properties -> Port Settings -> Advanced -> Change COM port number to an unused port number below COM10. If you have nothing free below COM10 disable a device which uses a COM and change to that COM port. Reboot your PC afterwards.
3) Remove and reinsert battery and enter tricolor bootloader, and connect with MTTY (USB)
hit enter and when the Cmd> prompt is shown type "task 2a" (this erases SPL, OS and Splash, we used to call that a "hard brick") => see screenshot "2. mtty-tricolor - task 2a.JPG"
After power cycling, the device will now enter the radio bootloader called oemsbl. Utterly the phone will look dead and the display is black, but it is still possible to connect with MTTY using the COM port as found in step 2. I indicate that in the next steps with MTTY (COMn) => see screenshot "3. mtty-com-connect.JPG". Also note that you never have to redo steps 1-3 again.
4) Remove and reinsert battery, switch on and connect with MTTY (COMn). Type "setboot", if you are connected correctly the reply should be "ARM9BootMode:0". If you see nothing check in device manager if the drivers are loaded. If you got the reply to "setboot" you can type "radata 90000000 1" which will put the phone in a special "dload mode". In some rare cases after "radata 90000000 1" you see "HTCSUN 0[=(HTCE" and the phone will not change state to dload mode. When that happens type "radata A0000000 2000" and this time nothing should be returned on screen and the phone changed to dload mode.
Again note that, like in step 2, nothing is echoed to screen!!
Close MTTY.
5) Replug USB cable !!
6) Run FrankenKaiser in a DOS box: FrankenKaiser-V1.9517.exe /dev/com9 SPL1.56-KAIS-unbricker.nb
(note substitute /dev/com9 by the com port indicated by diag driver in device manager, e.g. /dev/com4 on my PC)
You should see:
Code:
=== FrankenKaiser Unbricker for HTC Kaiser (c)2008 by jockyw2001
=== Jailbreaker for the 'Radio from Hell 1.65.17.10'
=== Donations happily accepted, paypal to [email][email protected][/email]
=== ATTENTION: only use this particular version with Kaiser:
=== radio version R1.65.17.10 - oemsbl HTC_BOOT V1.9517
SPL file read
Just be patient while I'm working ...
7e 02 6a d3 7e
Replug USB cable now!
Connect with MTTY and follow instructions !!!
If you don't see "7e 02 6a d3 7e" underneath the line "Just be patient while I'm working ...", you have either not replugged the usb cable, not installed the drivers correctly or type the wrong com port (/dev/comx) in the command line parameters.
=> see screenshot "4. dos box - frankenkaiser.JPG"
7) Run MTTY (COMn) and carefully enter following commands:
echo_on (the reply in MTTY should be "ECHO ON MODE")
setboot 1
=> see screenshot "5. mtty-echo_on setboot 1.JPG"
mb 9de8bc => dump HTC security area
mw 9de8bc 1 31313131 (replaces first half CID by SuperCID "1111")
mw 9de8c0 1 31313131 (replaces second half CID by SuperCID "1111")
mw 9de8e4 1 00000000 (Sets security flag to 0, sec unlocked)
mb 9de8bc => dump HTC security area again and check if CID and security flag are modified in memory
=> see screenshot "6. mtty-mb 9de8bc.JPG"
setinfo
powerdown
=> see screenshot "7. mtty- setinfo - powerdown.JPG"
Close MTTY
At this point your Kaiser is unjailed, security unlocked (and SIM unlocked) and SuperCID Now we need to prepare another run with FrankenKaiser to softload a SPL which will allow us to flash a HardSPL. In principle steps 1-7 need never to be done again.
8a) Unplug usb cable, remove and reinsert battery, replug usb cable and then power on. Connect with MTTY (COMn):
- type "echo_on". (the reply in MTTY should be "ECHO ON MODE". if you see that it means you never have to perform steps 1-7 again. If you don't, something went wrong in steps 1-7 or there is a connectivity problem)
- type "setboot 1" (you should see "ARM9BootMode:1").
- Close MTTY !!
8b) Unplug usb cable, remove and reinsert battery, replug usb cable and then power on. Connect with MTTY (COMn):
- type "echo_on". (you should see "ECHO ON MODE")
- type "dload" to put phone in dload mode.
- Close MTTY !!
9) Replug USB cable and then wait 10 seconds
10) Run FrankenKaiser in a DOS box: FrankenKaiser-V1.9517.exe /dev/com9 SPL1.56-KAIS-unbricker.nb
(note substitute /dev/com9 by the com port indicated by diag driver in device manager).
You should see the lines:
Just be patient while I'm working ...
7e 02 6a d3 7e
FrankenKaiser will prompt you to replug the usb cable. After you have done that you should wait about 10 seconds before proceeding with step 11.
11) Run MTTY (COMn)
- type "echo_on" (you should see "ECHO ON MODE", if not then there is a connectivity issue: close MTTY, unplug usb cable, wait 10 seconds, replug usb cable and repeat step 11.)
- type "setboot 0" (you should see "ARM9BootMode:0")
- type "cego" => tri-color screen should be visible and the reply in MTTY should be "Boot CE manually..." followed on the next line by "Done."
=> see screenshot "8. mtty-setboot 0 - cego.JPG"
If after "cego" you don't see a tri-color bootloader screen, then unplug usb cable and unplug and reinsert battery and try steps 8-11 again.
If still no tri-color screen, then repeat again but this time in step 10 run FrankenKaiser with the other SPL "sspl-0.92-jumpspl-force-usb.nb".
Close MTTY
12) Replug USB cable and flash HardSPL
13) Remove and reinsert battery, enter tricolor bootloader and flash Splash
14) Remove and reinsert battery, enter tricolor bootloader and flash OS
15) Remove and reinsert battery, enter tricolor bootloader and flash Radio
Note: at step 13 it's probably also possible to flash a full ROM update, I prefer to do it bits and pieces.
This I hope shows the power of FrankenKaiser: it manages to unjail, security unlock, SIM unlock and superCID a device which is basically in a bricked state w/o the need to flash a patched radio. Look forward to other FrankenKaiser tools such as a fast SPL loader and radio dumper.
Special versions of FrankenKaiser will be released for the new HTC models Diamond and Raphael and more
Remaining 3 screenshots attached and thumbnailed.
EDIT:
The attached Readme substitutes the one supplied with FrankenKaiser-V1.9517.zip
Might I be the first to say, Job well Done.
Edit:
I do have a question though. My phone is "Security Unlocked" thanks to you. However, I for the life of me cant get SPL1.1 JockyW with AT support flashed to my device no matter what I try. Is it possible to change SPL with this new Krankenkaiser software. Right now I have 1.0.Olipof SPL. Sorry, this might be the wrong thread. Just looking for a solution.
Thanks for the hard work. Seems like a daunting task to get it unlocked, but at least we have a method! Off to try it out!
Thanks again,
J
Wow. Good job man. Congratulations.
Well done brother
Thanks for your epic effort, will try when I get home.
Btw, read through your post twice and am confused with battery removal/reinsertion. First mention is remove and reinsert in same step, then later is reinsert without previous mention of remove. Lastly, reinsert. and again. and again. I'm really paranoid about digging myself a deeper hole...could you please clarify?
thanks for such a awesome tool and for your efforts.
p.s. i already security unlocked myself using ur tools so i fear no radio
P1Tater said:
Might I be the first to say, Job well Done.
Edit:
I do have a question though. My phone is "Security Unlocked" thanks to you. However, I for the life of me cant get SPL1.1 JockyW with AT support flashed to my device no matter what I try. Is it possible to change SPL with this new Krankenkaiser software. Right now I have 1.0.Olipof SPL. Sorry, this might be the wrong thread. Just looking for a solution.
Click to expand...
Click to collapse
if my 2 cents count i had to downgrade to wm6 to get it to work for me ...
haven't tried frankenkaiser so i don't know if that will do the trick.
thesire said:
if my 2 cents count i had to downgrade to wm6 to get it to work for me ...
haven't tried frankenkaiser so i don't know if that will do the trick.
Click to expand...
Click to collapse
I will give it a shot. I'll know more in a few.
well done!
seems like this is the ultimate tool for the Kaiser!
Good job
Many thanks, now i have radio 1.65.14.06
You are a genius!!!
I was really worried about all of the mtty commands, but your instructions were clearly written and easy to follow.
Thank you!
.....
NO MORE RADIO FROM HELL!!!!!!! WHOOOHOOOOO!!!!!!!!
Just to be absolutely sure...
You say 'Only works on Kaiser devices'. Might be a stupid question but having been burned once I make sure before I do anything now.
This WILL work on a Tilt right? Not just a Kaiser?
now I got a windows problem. When trying to manually install these drivers, windows find some random newer drivers on my system that possibly might not be the same drivers as the MotoQ. I think I gotta uninstall these drivers and choose the motoQ drivers. How do I do this?
dwsco said:
You say 'Only works on Kaiser devices'. Might be a stupid question but having been burned once I make sure before I do anything now.
This WILL work on a Tilt right? Not just a Kaiser?
Click to expand...
Click to collapse
Please read the Wiki ... Kaiser is a Tilt!!!
If you dont know this ... do not use this tool!
i get to the CEGO step, and my screen is not coming back on.. i followed instructions.. i had 1.1.JockyW spl on my device prior to flashing..
Code:
C:\FrankenKaiser-V1[1].9517>FrankenKaiser-V1.9517.exe /dev/com5 SPL1.56-KAIS-unbricker.nb
=== FrankenKaiser Unbricker for HTC Kaiser (c)2008 by jockyw2001
=== Jailbreaker for the 'Radio from Hell 1.65.17.10'
=== Donations happily accepted, paypal to [EMAIL="[email protected]"][email protected][/EMAIL]
=== ATTENTION: only use this particular version with Kaiser:
=== radio version R1.65.17.10 - oemsbl HTC_BOOT V1.9517
SPL file read
Just be patient while I'm working ...
7e 02 6a d3 7e
Replug USB cable now!
Connect with MTTY and follow instructions !!!
Code:
C:\FrankenKaiser-V1[1].9517>FrankenKaiser-V1.9517.exe /dev/com5 SPL1.56-KAIS-unbricker.nb
=== FrankenKaiser Unbricker for HTC Kaiser (c)2008 by jockyw2001
=== Jailbreaker for the 'Radio from Hell 1.65.17.10'
=== Donations happily accepted, paypal to [EMAIL="[email protected]"][email protected][/EMAIL]
=== ATTENTION: only use this particular version with Kaiser:
=== radio version R1.65.17.10 - oemsbl HTC_BOOT V1.9517
SPL file read
Just be patient while I'm working ...
Replug USB cable now!
Connect with MTTY and follow instructions !!!
Code:
echo_on
ECHO ON MODE
setboot 0
ARM9BootMode:0
cego
Boot CE manually...
Done.
i can also still communicate via mtty
NetrunnerAT said:
Please read the Wiki ... Kaiser is a Tilt!!!
If you dont know this ... do not use this tool!
Click to expand...
Click to collapse
As I said in my original post. I know a kaiser is a Tilt and visa versa... but I also know that doing something like this process is very device specific. I have read the Wiki and everything else and if you check up on any of my other posts you will know I'm not the kind of person that asks inane or pointless questions. If the devices were IDENTICAL and there were no differences, there wouldn't be a Tilt specific Wiki, and they wouldn't have different names.
I'm not looking for hand holding or walk throughs, just askling a simple question. As you imply by your "if you don't know this, don't use this tool" comment, this is not something to be approached lightly and without full knowledge of the possible repercussions.
I don't believe my question was unreasonable, and I don't believe I'm going to take the type of answer you have provided as a valid one either. What you're saying is similar to saying hey, it's a Ford Mustang so of course you can use any Ford Mustang Cam, and if you don't know that you shouldn't be trying to change the cam... obviously wrong and obviously very unhelpful.
I don't believe verifying a tools proper use is being ignorant... just careful.
'nuf said.
Okay, so I was got as far as the end of step 2, just loaded the drivers (my computer loaded them as the BenQ drivers as well, don’t know what that’s about) and then had a power outage (apparently a bird landed on something it wasn’t supposed to and knocked power out for about 5 minutes, how very Alaska right?) Anyway, now I’m stuck cause the screen remains black. The power comes on and the computer shows the device connecting, but I can’t do anything. So I don’t know how screwed I am or not, but I don’t know where to go from here. So if anyone has the time or desire to help me out I’m online @ scotchua2000 for AIM and [email protected] for MSN, and of course I’ll be monitoring any posting on here. Thanks.
***sucessfully unlocked***
Qualcuno che parla italiano? ho un problema, ho eseguito la procedura ma mi si è bloccato. ora non si accende lo schermo resta la luce verde..... il pc riconosce che è collegato (vede i driver qualcomm).. aiuto...
Hey,
this is my first post, and i 've a bad experience to tell u
I execute the bad command task 2a on MTTY and i brick my poor polaris...
this is the output on mtty:
Cmd>task 32
Cmd>task 28
Format start
Fill RSVD information for block 288 to 309
Storage start sector=0xD780, total sector=0xDB40
Storage start block=883, total block=877
Total Bad Block in CE: 1
Erase physical block from 1174 to 2032
si backup: Erase physical block from 2032 to 2048
Format end
Cmd>task 2A
Format ALL start
backup SPL OK
backup MISC configuration OK
SPL start start block=288, total block of CE=1760
ERASE block 878 FAIL !!!
Write 0xFF start page=0x4800, total page=0x1B800
SPL version and MFG TAG are same, skip it.
restore SPL OK
restore MISC configuratoin OK
restore MFG configuratoin OK
Format ALL end
Cmd>info
Cmd>info 8
--- 2K bytes sector version ---
DEVICE NAME=samsung_k9k2g08
DEVICE ID=0xAA
DEVICE MAKER ID=0xEC
PAGE SIZE=0x800
TOTAL PAGE SIZE=0x840
BLOCK COUNT=0x800
BLOCK PAGE=0x40
Checking block information
BLOCK 878 (0x36E) is bad block
OS NOT FOUND !!!
Cmd>task 8
Click to expand...
Click to collapse
and finally i found my phone dead, when i press the power button nothing happen i have always blank screen, i try with any possible solution, hard-reset (i can't put in bootloader mode), FrankenKaiser tool but my phone accept only command setboot and nothing else.... (always invalid command)
Is there any working method to unbrick?
Can htc service resolve my dreadful issue??
Thanks to everybody
Hi there,
i've the same problem, MTTY can't accept any command rather than the default security locked commands.
I believe it's not fully bricked as i can connect via the MotoQ drivers and issue some mtty command, but i've erased all SPL, OS and bootloader, so i wish to recover it using also your intelligence and skillsets.
Anyone can help me?
Thank you!
Jakk
Read this post http://forum.xda-developers.com/showpost.php?p=5369709&postcount=438 to security unlock and repair your phone.
It doesn't work, since that executable doesn't work! I guess it is a fake.
Sent from my Liquid using XDA App
jakketto said:
It doesn't work, since that executable doesn't work! I guess it is a fake.
Sent from my Liquid using XDA App
Click to expand...
Click to collapse
You guess wrong, it is not a executable you run it from a dos box read http://forum.xda-developers.com/showthread.php?t=393337
it's just a patched version of FrankenKaiser.
Hi,
I've run it from a DOS prompt, but the executable gave me an error regarding some .NET and other missing library....
Sent from my Liquid using XDA App
Id guess your missing .net framework without knowing the errors or os i dont know.Try posting more informative answers other than "it doesnt work" you might get more help.If you can connect with mtty it can probably be recovered,but it's harder to recover than to brick.
well hi....
my polaris is dead. managed to conect mtty wia motoq drivers and mtty. issued commands but canot dwl frankenkaiser and a polaris 200 spl
ion_plugged said:
my polaris is dead. managed to conect mtty wia motoq drivers and mtty. issued commands but canot dwl frankenkaiser and a polaris 200 spl
Click to expand...
Click to collapse
I think FrankenKaiser by JockyW can not run on yours, because the existing version of the SPL in the package contrary to the SPL that you use ...! can you understand it, so you should be able to modify it. if you do not get any better you PM just JockyW on condition .......... you'd better ask him directly on what the requirements
Just use jpeg001 patched version of frakenkaiserhttp://forum.xda-developers.com/showthread.php?t=393337&page=44If you need the spl http://forum.xda-developers.com/showthread.php?t=381600&highlight=originalspl
ion_plugged said:
my polaris is dead. managed to conect mtty wia motoq drivers and mtty. issued commands but canot dwl frankenkaiser and a polaris 200 spl
Click to expand...
Click to collapse
Hi,
Have you repair your Device,if not,you solution is JTAG(Riff Box,ORT Tool)!?
Contact me,if you need help and I can repair via JTAG.
meknb said:
Just use jpeg001 patched version of frakenkaiserhttp://forum.xda-developers.com/showthread.php?t=393337&page=44If you need the spl http://forum.xda-developers.com/showthread.php?t=381600&highlight=originalspl
Click to expand...
Click to collapse
I think there is only one possible way to restore the hard brick, with Franken SPL Loader .....
Hakim Rahman said:
I think there is only one possible way to restore the hard brick, with Franken SPL Loader .....
Click to expand...
Click to collapse
spl loader will only work on a security unlocked phone.
Hi there! This was my experience with Android:
http://forum.xda-developers.com/showthread.php?t=792004
I had a couple problems when I was with WM. Sleep of death and so on.
Changed SD card and it seemed to be working fine.
Now, I need my phone so switched back to WM.
Install wizard went fine. But now it doesn't boot
Linux Kernel keep saying me "block xxx bad" where xxx is a number (578, 543 and 643).
What can I do?
Pleeease help! =(
Thanks a lot!
hi
same thing nappened on my polaris 200. 2 bad blocks on nand. android works fine. task 28 helps (format nand). is there a solution to skip bad sectors?
ion_plugged said:
same thing nappened on my polaris 200. 2 bad blocks on nand. android works fine. task 28 helps (format nand). is there a solution to skip bad sectors?
Click to expand...
Click to collapse
Android works, too. But it doesn't take too much to hang and start with those force-closes errors.
I did task 29. I don't know if it's the same.
Hi! I was out for exams at University.
Last thing I tried was doing task 2a at MTTY.
I know, BIG BIG mistake. Polaris is dead since then.
I'm living now with a Siemens [email protected] LOL.
Is there any new with this? Is there any procedure I can do to bring it back?
I don't have enough money to send it to service
Seems the polaris gets to an end because of hardware reasons.
i have the first bad block as well.. dont know.. i cant get wifi to work atm i hope its working after wimo flash again.
As far as i know after your 2A the device is dead.
I think repair would be more than buying a new device.
Maby you can try your luck on a wildfire. Here in germany was a action, offering it for 100€ and many people bought more thanh one device to set it on ebay.
Moved of: HTC Polaris: Touch Cruise > Touch Cruise ROM Development
To: HTC Polaris: Touch Cruise > Touch Cruise General
Please put your questions to: Touch Cruise General
dertester123 said:
As far as i know after your 2A the device is dead.
Click to expand...
Click to collapse
There is a patched version of frankenkaiser for the polaris to recover from a task 2a.
dertester123 said:
Seems the polaris gets to an end because of hardware reasons.
i have the first bad block as well.. dont know.. i cant get wifi to work atm i hope its working after wimo flash again.
As far as i know after your 2A the device is dead.
I think repair would be more than buying a new device.
Maby you can try your luck on a wildfire. Here in germany was a action, offering it for 100€ and many people bought more thanh one device to set it on ebay.
Click to expand...
Click to collapse
I read somewhere that bad blocks are common, even if the device is brand new. The point is that it seems there are certain blocks that cause bad functionality if they're damaged. :/
Buying a new phone isn't a solution for me, since I don't have enough money for that.
mmelo76 said:
Moved of: HTC Polaris: Touch Cruise > Touch Cruise ROM Development
To: HTC Polaris: Touch Cruise > Touch Cruise General
Please put your questions to: Touch Cruise General
Click to expand...
Click to collapse
You're right, wrong forum.
Thanks for moving!
meknb said:
There is a patched version of frankenkaiser for the polaris to recover from a task 2a.
Click to expand...
Click to collapse
I tried the patched version made by jpg001. But it gets stuck in
Code:
Just be patient while I'm working ...
7e 4e 7e
I'll give a try again tonight with every FrankenKaiser version possible.
I really need my Polaris back
Those numbers don't look right
Code:
Just be patient while I'm working ...
7e 4e 7e
are the motoq drivers installed ?are using the right port ? don't try another frankenkaiser version as they will flash the kaiser spl which won't work you need a copy of a original spl.nb.
meknb said:
Those numbers don't look right
Code:
Just be patient while I'm working ...
7e 4e 7e
are the motoq drivers installed ?are using the right port ? don't try another frankenkaiser version as they will flash the kaiser spl which won't work you need a copy of a original spl.nb.
Click to expand...
Click to collapse
That happens in step 10.
MotoQ drivers installed works with mtty, QPST and the step 7 of the guide.
I'll try downloading new ones tonight
The drivers seem fine if you can connect with mtty ect.What is your SECU_FLAG "security unlocked" in mtty try setinfo 8,the button combo for 8b is keep your finger on the green send button and the power button,that will boot into oemsbl on a security unlocked polaris.
meknb said:
The drivers seem fine if you can connect with mtty ect.What is your SECU_FLAG "security unlocked" in mtty try setinfo 8,the button combo for 8b is keep your finger on the green send button and the power button,that will boot into oemsbl on a security unlocked polaris.
Click to expand...
Click to collapse
Thanks A LOT for your response.
I'm not at home right now. Tonight I'll post the results, but as far as I remember, every field was blank.
Faulty nand
Well i am here after a task 2a. android and wm wont flash, redio did not change and i formated the nand. i have moto q drivers and i am connected to mtty but i don't have a workuing frakin kaiser for polari (some dll mising and corrupted archives) and i don't have an original spl. from where can i take one?
meknb said:
The drivers seem fine if you can connect with mtty ect.What is your SECU_FLAG "security unlocked" in mtty try setinfo 8,the button combo for 8b is keep your finger on the green send button and the power button,that will boot into oemsbl on a security unlocked polaris.
Click to expand...
Click to collapse
Ok, this is my output:
Code:
SetHTCRegionInfo: block=0, CID=, PID=, IMEI=, SECU_FLAG=0
oemsbl 1
Later I'll screenshot every step. Maybe I'm doing something wrong.
ion_plugged said:
Well i am here after a task 2a. android and wm wont flash, redio did not change and i formated the nand. i have moto q drivers and i am connected to mtty but i don't have a workuing frakin kaiser for polari (some dll mising and corrupted archives) and i don't have an original spl. from where can i take one?
Click to expand...
Click to collapse
Here you are:
CYGWIN1.DLL: http://www.mediafire.com/?l7m92ix5cdknmum
And for SPL, you should extract it by using "NBHEXTRACT" (search this forums for it), and run it with your stock ROM. It will give you the original SPL file.
Regards!
Sorry for double-posting. I'm acting like a total noob. I am.
This is what I did:
Notes:
- I usually get some error after typing the first command.
- CYGWIN1.DLL used is the same as I posted before. Got it from the Internet.
4) Connect MTTY COM4.
Type "setboot".
Type "radata 90000000 1". Nothing is echoed to screen.
Close MTTY.
5) Replug USB cable.
(I called FrankenKaiser.exe as fkaiser, for faster typing)
6) Run FrankenKaiser in a DOS box: fkaiser.exe /dev/com4 SSPL.nb.
Got "7e 02 6a d3 7e"
Replug USB cable.
7) Run MTTY and type:
Code:
echo_on
setboot 1
mb 9debbc
mw 9debbc 1 31313131
mw 9debc0 1 31313131
mw 9debe4 1 00000000
mb 9debbc
(as I did this many many times, nothing is changed).
Code:
setinfo
powerdown
Close MTTY
8a) Unplug usb cable, remove and reinsert battery, replug usb cable.
Connect with MTTY:
Code:
echo_on
setboot 1
Close MTTY.
Uploaded with ImageShack.us
8b) Unplug usb cable, remove and reinsert battery, replug usb cable.
Connect with MTTY:
Code:
echo_on
dload
Close MTTY.
Right before "dload" command, I'm pressing Send (green button) and power button all togheter.
9) Replug USB cable and then wait 10 seconds.
10) Run FrankenKaiser in a DOS box: FKaiser.exe /dev/com4 SSPL2.nb
NOTE: My SSPL2.nb was extracted from HERE (XDA FTP) with NBHExtract.exe.
Get "7e 4e 7e", not "7e 02 6a d3 7e"
11) Replug USB cable, wait 10 seconds.
Run MTTY:
Code:
echo_on
setboot 0
cego
Pressing camera button right before typing "cego".
MTTY doesn't show anything. Typed 3 times "echo_on", and nothing. Tried anyway to proceed, but unsuccessfully .
Here is the link of the extracted SPL from the original ROM, and the extracted SMI.BIN from QPST, if it helps for something.
Original SPL: http://www.mediafire.com/?pt4958k9isw77k2
SMI.BIN: http://www.mediafire.com/?bmupdccl78sicu0
Your phone is security unlocked so you wont need to run the mb mw commands in step 7 again that's just for security unlocking, its just step 10 where it's failing you could try setboot 1 before dload ie
Code:
echo_on
setboot 1
dload
Do you know which radio version you have?
meknb said:
Your phone is security unlocked so you wont need to run the mb mw commands in step 7 again that's just for security unlocking, its just step 10 where it's failing you could try setboot 1 before dload ie
Code:
echo_on
setboot 1
dload
Do you know which radio version you have?
Click to expand...
Click to collapse
Thank you very much for your response.
As MTTY says, my radio version is 1.59.46. It should work with FrankenKaiser.
Maybe the SSPL2.nb I'm using is not the correct one.
I'll try right now
EDIT: I tried with setboot, without doing all the steps, but FrankenKaiser keeps me throwing "7e 4e 7e".
The only other thing i can think of is try booting with the power button and the end key "red one" i cant remember what mode that boots.If you have qpst you can check what mode your phone is in once you find out its in dload mode run frankenkaiser.
The original spl's are all here
meknb said:
The only other thing i can think of is try booting with the power button and the end key "red one" i cant remember what mode that boots.If you have qpst you can check what mode your phone is in once you find out its in dload mode run frankenkaiser.
The original spl's are all here
Click to expand...
Click to collapse
You're right, thanks. I'll check with QPST which mode is my phone in.
By now, I tried the following combinations:
Power + Camera + Send
Power + Camera + End
Camera + Reset press
And still "No phone". I'll let you know any news
EDIT: Tried every combination possible, still nothing.
When i enter "dload", any command written on mtty won't response. And QPST still saying "No Phone".
I know the device is security unlocked because if I write "h" I get this command list:
Code:
For a help screen, use command ? or h
Available monitor commands are:
? [command]
h [command]
mb [StartAddr [Count [Filler]]]
mh [StartAddr [Count [Filler]]]
mw [StartAddr [Count [Filler]]]
setboot [0/1/2/3]
setatcmd [0:SIO/1:UART/2:USB/3:DPRAM]
setsmdloop [0:disable/1:enable]
setmpatch [0x1: CPU Freq/0x2: acoustic/0x4: simdoor/0x8: RTC]
setiot [0:Disable/1:Enable]
eraseall [erase all setting flags]
setdiag [0:USB/1:UART/2:DPRAM/3:SIO]
partition
checksum
format
setinfo
readadc
cego
setgpio
getgpio
gpio
version
powerdown
platformid
radata
showexplog [n]
usbdppulldown [n]
usbdmpulldown [n]
usbdppullup [n]
usbdmpullup [n]
Headsetpullhigh [n]
rfid
wpmic [PM_VREG] [0/1]
Have you checked the port's on qpst under add new port untick show serial and usb/qc diagnostic ports.I've just checked on mine if i power on with my finger on the end key it say *download* in qpst.
In this threat i gonna upload some patched frankenkaisers for different versions.
With "FrankenKaiser" you can unbrick "task 2a" bricks:
There is no SPL, Splash and OS present as "task 2a" formats the entire application area.
Before FrankenKaiser there was no method available to unbrick and therefore they were called "hard bricks"
With frankenkaiser you can also revive kaisers where you don't see anything on it but is detectable (after turning on your device) in windows as an other device:
you got stuck in the OEMSBL and you can only talk to your device with mtty.
Credits goes to Jocky Wilson who created the original frankenkaisers. (Paypal to [email protected])
I've only changed them to work with different versions.
These versions are created at forum user requests.
Method to dump your rom:
1. connect your bricked phone and power it on
2. connect with MTTY to diag port COM#: (look up # in device manager)
3. type "radata" followed by enter (you'll see a parameter error message)
4. type "GO2AMSS" followed by enter
5. your phone should now change to "QC download mode"
6. use "QPST Memory Debug" tool to dump smi.bin and ebi.bin
7. zip smi.bin and upload it to Rapidshare (or any fileshare service) and send me the link
oemsbl: V1.9309
Radio: V1.71.09.XX
Verified.
oemsbl: V1.9519
Radio: V1.70.19.XX
20110823: new version uploaded
oemsbl: V1.9529
Radio: V1.65.29.21
oemsbl: V1.9518
Radio: V1.70.18.xx
Frankenkaiser for other versions can be created in this thread
Excellent work massivekid, just what I needed to fix the 600+ bad blocks on my spare Kaiser! Thank you!
You da MAN!!!
Turns out I cannot use any of this because my laptop has NO COMM ports.
Unless I can find a USB to serial adapter and force a COMM port, I'm stuck.
You don't need a com port. If your phone is in OEMSBL then it will ask for a different driver. This driver will create a virtual com port on your computer thru USB.
First of all, thanks for creating frankenkaisers for different radio versions,
but I need some help, my radio is version V1.71.09.XX, I did all the steps to rescue the phone up to step 11, and when I connect the usb to computer, windows shows an error and wont recognize the usb connector, not allowing me to flash the hard spl through usb. would be absolutelly happy if you would help me solving this.
Do you see the tricolor screen?
Did you disconnect and reconnect the usb cable again and do you see USB on the tricolor screen?
if no usb is seen, redo steps 7-10 again (after pulling your battery) but this time in step 9 run FrankenKaiser with the other SPL "sspl-0.92-jumpspl-force-usb.nb".
this will force usb detection.
i redid steps 7-10 at least 10 times already, tri-color screen shows up with the first spl and gives problem when connecting the usb, when I try the 0.92 spl the screen stays black (I tried connecting the usb even with it staying black and the same error message showed up)
*During the whole step by step the only difference I saw between my results and the screenshots was the oesmbl version on screenshot 7, where instead of a "2" there was a "1"
And did you tried the "sspl-0.92-jumpspl-force-usb.nb" at step 9?
If you enter mtty and type ? or h what is the output of the command?
if you see a lot of commands, then your device is security unlocked.
the "sspl-0.92-jumpspl-force-usb.nb" file is to force USB connection so you can connect with usb.
If that doesn't work, try with the original spl and after cego, pull the usb cord quickly and if the tricolor appears, try to connect the usb again.
after typing "h"
Available monitor commands are:
? [command]
h [command]
mb [StartAddr [Count [Filler]]]
mh [StartAddr [Count [Filler]]]
mw [StartAddr [Count [Filler]]]
setboot [0/1/2/3]
setatcmd [0:SIO/1:UART/2:USB/3PRAM]
setsmdloop [0:disable/1:enable]
setmpatch [0x1: CPU Freq/0x2: acoustic/0x4: simdoor/0x8: RTC]
setiot [0isable/1:Enable]
eraseall [erase all setting flags]
setdiag [0:USB/1:UART/2PRAM/3:SIO]
partition
checksum
format
setinfo
readadc
cego
setgpio
getgpio
gpio
version
powerdown
platformid
radata
showexplog [n]
usbdppulldown [n]
usbdmpulldown [n]
usbdppullup [n]
usbdmpullup [n]
Headsetpullhigh [n]
rfid
wpmic [PM_VREG] [0/1]
the "sspl-0.92-jumpspl-force-usb.nb" gives only blackscreen on the phone, no tri-color.
I`ll try the first spl and take out the usb quickly.
Same result after pulling usb quickly after doing the command "cego"
Tried the same with sspl-0.92 and the blackscreen apears the same way, and the error message on windows is the same:
(translation might no be exact because my windows is in portuguese)
"One of the usb devices connected to this computer had a problem and windows can not recognize it. to get help click on this message.
After clicking it shows a windows with a root usb hub, 4 usb doors being one of them the one where the phone is connected with a red X before it.
Ps.: I`m not exactly sure, and I don`t know if this might influence on anything, but if I remember right, when first unlocking my phone, the JumpSPL1.56-KAIS.exe wasn`t effective, I needed using one of the other 2 jumpspl available on that thread.
With "sspl-0.92-jumpspl-force-usb.nb", you can also try after cego to press and hold camera to enter tricolor bootloader mode
Also you can try this spl: SPL3.56-patch-nostuckinSPL-FORCEUSB.nb at step 9?
Just unzip it in your folder and use it.
when using the sspl0.92 it wont go out of the blackscreen (even holding camera button), and the same error message is shown on usb
when using the new spl3.56 the usually blinking green led stay orange after the cego command and the screen stay black, tried holding the camera button, to no effect in either "spls".
Same usb error on three spls...
The error states that the device is halted and is not handling usb functions anymore. The one that has the tricolor screen, should work, but some devices are not detecting the usb correctly. Therefore the usb force spl are created.
I'll try to find out how we can overcome this...
thank for your attention and taking your time to help me, hope you can find a solution, surelly you will help many kaiser owners that got many "bad blocks" in memory...
(shouldn`t ever have tried to put android on nand...)
keep me informed on any kind of progress and let me help you on testing.
Ok, try this one:
Remove and reinsert battery, then hold the send button and power on. Connect with MTTY (COMn) and this time enter "dload" to put phone in dload mode Continue with step 9.
Try SPL1.56-KAIS-unbricker.nb then or sspl-0.92-jumpspl-force-usb.nb
tried it, no letters under the: "Just be patient while I'm working ..."
believe the phone hunged up, will try again.
(also tried using the send button whenever turning the phone on in the steps 7 through 10, nothing different happened, I believe the jumpspl can only be loaded while in setboot 1 I`m thinking about trying to use "cego" without typing setboot 0 before...)
Phone will absolutelly lock if I dont enter setboot 1 in the step before typing dload,
frankenkaiser isn`t able to access it (no letters under te message to wait) and it locks after the frankenkaiser attempt (wont accept mtty commands), removing battery returns to "normal" (as in dead kaiser).