Bootloader password needed to make a dump of the ROM

[BeyondtheTech]

I decided to tinker in the Wizard's bootloader mode. I found that the "d2s" command that people have used on other devices' bootloader mode does not work on the Wizard. However, the "r2sd" command does allow you to write a specific portion of the ROM to a memory card... provided you can provide the right password to enable the feature. Right now, I'm getting this error message:Cmd>r2sd all
***** user area size = 0x1E980000 Bytes

R2SDBackup() - Download type = 6
usTotalBlock = 1 sizeof(SDCARD_SIGNATRUE_TABLE)=512

You didn't get the proper security level to download a specific image

Cmd>
According to other people performing ROM dumps and accessing bootloader commands, you need to type "password [password]" and you'll be able to get the "proper security level." The only problem is, what do I put in for [password]? I've tried WIZARD and PRODIGY and TYPHOON, since those were the passwords of the previous devices, but none work so far. Apparently, if I get the right password, I'll be greeted with a different prompt.

By the way, if we get the right password, this is what the "r2sd" command can supposedly grab.
Cmd>r2sd
Usage:

r2sd (ipl/spl/splash/os/gsm/ffs/all/gsmdata/diag/extrom/htclogo)

Backup DOC image to SD card .

Cmd>
Hey, I see the words "splash" and "htclogo" in there! So, anyone got any bright ideas?

[IamGuest]

Cmd>r2sd
Usage:

r2sd (ipl/spl/splash/os/gsm/ffs/all/gsmdata/diag/extrom/htclogo)

Backup DOC image to SD card .

Cmd>



Did you try "r2sd os" or "r2sd gsm"?
what is the result from these commands?

[Mashie]

Is the Wizard bootloader locked? If so, is there anyway to unlock it?

[arnoldl]

if you have it unlocked at imei-check.com (even with no simlock)
You will get a new bootloader installed.

and from there you can dump without a password..

Cmd>r2sd all
***** user area size = 0x1E3E0000 Bytes

R2SDBackup() - Download type = 5
usTotalBlock = 1 sizeof(SDCARD_SIGNATRUE_TABLE)=512

Start address = 0x80000000 , Length = 0x800
Start address = 0x80000800 , Length = 0xC0000
Start address = 0x800C0800 , Length = 0x40000
Start address = 0x80100800 , Length = 0x280000
Start address = 0x4E3D4C0 , Length = 0x3900000
Start address = 0x743D4C0 , Length = 0xA00000

SD user size = 0x1E3E0000, Image total size = 0x4680800
1 Start=0x80000000, Length=0x800, Checksum=0xEC197E45
+WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0x800
WriteDataToSDCard() ulTargetSDAddr=0x200 pusSourceAddr=0x8C100000 dwTotalBlock=0x4
-WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0x800
2 Start=0x80000800, Length=0xC0000, Checksum=0xB73A3E59
+WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0xC0000
WriteDataToSDCard() ulTargetSDAddr=0xA00 pusSourceAddr=0x8C100000 dwTotalBlock=0x600
-WriteDataToSDCard() - pusSourceAddr = 0x8C180000 , ulSourceLength=0xC0000
3 Start=0x800C0800, Length=0x40000, Checksum=0xDE71BB6B
+WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0x40000
WriteDataToSDCard() ulTargetSDAddr=0xC0A00 pusSourceAddr=0x8C100000 dwTotalBlock=0x200
-WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0x40000
4 Start=0x80100800, Length=0x280000, Checksum=0xCCF373AE
+WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0x280000
WriteDataToSDCard() ulTargetSDAddr=0x100A00 pusSourceAddr=0x8C100000 dwTotalBlock=0x1400
-WriteDataToSDCard() - pusSourceAddr = 0x8C380000 , ulSourceLength=0x280000
5 Start=0x4E3D4C0, Length=0x3900000, Checksum=0x7754CD01
+WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0x3900000
WriteDataToSDCard() ulTargetSDAddr=0x380A00 pusSourceAddr=0x8C100000 dwTotalBlock=0x1C800
-WriteDataToSDCard() - pusSourceAddr = 0x8FA00000 , ulSourceLength=0x3900000
6 Start=0x743D4C0, Length=0xA00000, Checksum=0x91C3A10A
+WriteDataToSDCard() - pusSourceAddr = 0x8C100000 , ulSourceLength=0xA00000
WriteDataToSDCard() ulTargetSDAddr=0x3C80A00 pusSourceAddr=0x8C100000 dwTotalBlock=0x5000
-WriteDataToSDCard() - pusSourceAddr = 0x8CB00000 , ulSourceLength=0xA00000
Double Check 0 Start=0x80000000, Length=0x800, Checksum=0xEC197E45
Double Check 1 Start=0x80000800, Length=0xC0000, Checksum=0xB73A3E59
Double Check 2 Start=0x800C0800, Length=0x40000, Checksum=0xDE71BB6B
Double Check 3 Start=0x80100800, Length=0x280000, Checksum=0xCCF373AE
Double Check 4 Start=0x4E3D4C0, Length=0x3900000, Checksum=0x7754CD01
Double Check 5 Start=0x743D4C0, Length=0xA00000, Checksum=0x91C3A10A
usTotalBlock = 1 sizeof(SDCARD_SIGNATRUE_TABLE)=512

+WriteHTCSignature,download type = 5
Common Info Checksum=0xC8AFBD04

-WriteHTCSignature...

grtx , arnold

[pdapro]

but the http://www.imei-check.co.uk/m3000unlock.php doesn't provide service for dopod 838.

[arnoldl]

mhh i think it's for all htw wizard based phones.
But not sure.

did you mail them already???

[eurorpeen]

Hi,

28 € for what we used to do for free ??????

Not interested !

[BarnOwl]

Hi,

28 € for what we used to do for free ??????

Not interested !

We??? ......If you want to unlock it now there are two options: Paying 28 Euro at i-mei check or paying 120 Euro at T-Mobile.
There is no free unlocking tool yet.

[arnoldl]

that's your own choice .

I'm convinced that between now and 1-2 months the tools are freely availeble.

Only i'm still in switching numbers , and would like to use my old orange card for the time being.
so it's worth the e28 to me.

(and got a passfree bootloader)
But i didn't say you have to do it...

grtx , arnold

[eurorpeen]

Hi,

By "we", I was saying "the users of the previous models"
And no, if I can, I will not pay 28 € to unlock a phone that will be obsolete before 6 months.
Do you see its successor (for 03/2006) ? A beauty with UMTS and everything else, even an Intel 416 MHz processor.
So for the moment, my S110 will continue to work flawlessly

:P :P :P :P :P

[_Belial]

Hi all,

I want to flash the Qtek rom onto my vario as it's giving me nothing but grief, could someone please tell me how do i backup my t-mobile rom so that i can restore it at a later date?

I see talk of this r2sd command, but how do i send that to the phone? how do i then restore this backup from the SD? is there an app i can run which will save the backup to a file so i can save it on my pc for restoration later?

Thanks in advance

P.S : I have unlocked the phone using the software at imei-check.co.uk

[arnoldl]

@belial

http://forum.xda-developers.com/viewtopic.php?t=32866

[_Belial]

Thank you arnoldl, i'll go try flash with the qtek one now, can't do any harm anyway as in it's current state it's next to no use :)