Dead wlan due to erased eeprom? *SOLVED*

[drummer10630]

Needed tools:

PuTTY ver.6 or above
Plink
Active Sync 4.5
any Hex editor
MTTY1.exe ver 1.11a
Windows PC
SPL 2.30 Olipro
SPL 1.01 MFG pack
SPL 1.10 Oli w/custom RUU
SPL 1.04 w/custom RUU
DUTTY'S Good .NB Tool
Win Rar
Hermes with working wlan

There are steps for the user with the device with the working wlan eeprom, and steps for the user with the device with the corrupted or missing wlan eeprom. Basically what you will be doing is cloning the MAC of a device with a working wlan, editing it, and flashing it to your device with the non-working wlan.

Steps for Working Wlan Device:

You need to get SPL Oli 2.30 (found on the XDA DEV FTP Site in the HERMES/HardSPL folder) on the working device. You can do this by following the downgrading bootloader page at:

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

Assuming you have HardSPL v7 on your device (as most of you have been doing upgrades and downgrades), follow the steps to downgrade to Oli 1.10 then to SPL 1.04, (read and execute carefully)

then use DUTTY'S Good .NB Tool...

http://forum.xda-developers.com/showthread.php?t=296311

...to convert the SPL Oli 2.30 .nb file contained in the .rar you downloaded (use WinRar to extact) to an .nbh file (RUU_signed) THEN flash SPL 2.30 (you can use the same custom RRUwrapper you used to flash to 1.04 by putting it in the same folder, but move the RUU_signed.nbh of 1.04 to another folder first, then put it back when your finished)


Download PuTTY and Plink and copy them into your C:\Windows\Temp folder

http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

Put your device in bootloader mode and disable USB connections in Active Sync


Connect to the PC and open PuTTY
Click SERIAL, and make the speed 115200, and type \\.\WCEUSBSH001 (all CAPS) in the space for SERIAL LINE (overwrite what is there) or connect with MTTY first...

http://forum.xda-developers.com/download.php?id=9864

... and copy and paste the address into PuTTY then close MTTY. Type HERMES into the space named SAVED SESSIONS and hit SAVE. Hit OPEN. Press ENTER to get a CMD prompt...you will see a green cursor. Type Task 32 and it will return Level=0. Ok, close PuTTY as you have verified that it's working.

Sometimes your device will be seen as \\.\WCEUSBSH002 or \\.\WCEUSBSH003, just use which ever it connects to.

Now the next bit is tricky because you you will do it "blind" as in this mode, Plink does not have local echo so you won't see what you're typing.

Go to START/RUN/CMD

This opens a DOS window. Change directories to C:\Temp and type the following:


plink HERMES > herm1.nb (hit ENTER TWICE) (you will see the new file herm1.nb written in your Temp folder) (notice the spaces before and after the > sign)

Now type the following and hit ENTER (once) after each command:

task 32
password 0000000000000000 (that's 16 zeros)
set 1e 1
rbmc me.txt 500a0000 40000

that will copy the wlan section of the eeprom nand to the file called herm1.nb. You can right click on the file, select properties, and see that it grows to 256k-257k.

When it's done creating the file (to 256k or 257k, you'll see it doesn't get any bigger), press CTRL C in DOS to close plink and it saves the file at 257k size.

Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).


Now, since you've basically cloned another's MAC address (already allocated to another device), it's necessary that you change your MAC address ASAP. Instructions on how to do that below:

In the edited herm1.nb file, go to the MAC Address at offset 0001F850 and change the 2nd, 3rd and 4th bytes from the right... (it's your MAC address in reverse), to ANY numbers you like, keeping the same format. This 6 byte sequence is your NEW MAC ADDRESS. The last 3 numbers of the MAC (which appear in opposite order) can be "invented".

You now have the eeprom flash file to be transfered to the non working device...


Steps for Non-working Wlan Device:

Using the methods on MrVanx's downgrading SPL page...

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

...downgrade again to SPL 1.04, then flash SPL 1.01 MFG. When flashing and using SPL 1.01 MFG, some users suggest you only use the version of MTTY that comes with the MFG Pack.

http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG

Read the full instructions before flashing.

Ok, now that you have verified that you have SPL 1.01 MFG on the device, put in bootloader mode, disable USB connections in Active Sync. Connect the device and open MTTY. Make sure you have copied your herm1.nb file into the same folder as MTTY.

Connect to the device (\\.\WCEUSBSH001)
and hit ENTER to get a CMD prompt

Now type the following:

task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000

Hitting ENTER after each command.

When it's done, close MTTY and reboot your device and verify that your Wlan is now working...

Then I recommend flashing HardSPL v7 or SPL 2.30 to your device right away (because you know you won't leave your device alone and we don't want you bricking your Hermes, do we?)

BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:

plink HERMES > full.nb (hit ENTER twice)
task 32 (hit ENTER once and only once from now on after every command)
password 0000000000000000
set 1e 1
rbmc me.txt 50000000 7fff800

watch your file grow to 128 MB.

If you ever need to flash the entire eeprom nand, just edit it as above so you take out the commands you typed (HTCS-HTCE) and you're good to go...

Thanks go out to Pof and Olipro for doing the initial research on this issue. And also to members Laikos and Panzer who helped tremendously.

Tested on Cingular 8525 Wm6 VP3G modified AT&T rom, and Orange m3100 WM6 cooked rom based on Dopod 3.54.707.3 rom.

*NOTE* Olipro just posted later in this thread

"just to point out guys;
to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary"

another member (dan1967) suggested that one only have to use SPL 2.60 Oli Hard SPL v9 Developer Edition to do this procedure and one can avoid the upgrading and downgrading of bootloaders...

Member alakentu has translated this method into Spanish. The thread is here:

http://forum.xda-developers.com/showthread.php?t=364751


***DISCLAIMER.....TRY AT YOUR OWN RISK, WE ARE NOT RESPONSIBLE FOR ANY MALFUNCTIONS OR OTHER ISSUES THAT MAY OCCUR.***

For those of you who used my guide to fixing your dead Wlan on Hermes, please feel free to make a donation via paypal if you feel I've helped you in some way. Any amount will be very much appreciated, and I could really use the cash, hee hee, thanks in advance. Just click the PayPal Logo below to donate.

[belu]

cool !! I try this if i found a phone with no dead wlan ;)

[panzer]

nice.........

[laikos]

It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.

Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.

[chrisvor]

Would it be possible for someone to extract the eeprom file from a working wlan device, "zero-out" the MAC address portion, or replace with 'FF' or some other 'dummy' value, and post this here, so those of us without access to a working device can use to flash our damaged devices?

By "blanking-out" the MAC address in the attached file, you dont risk having your MAC address used by everybody, so there is no "legal" risk, and help us without a working device to fix ours...

Thanks for the solution guys and hopefully you can post the file here for us to use.

Good work !! :)

[nicoebra]

Thank you very much for this solution !!!! Great job!
But as said chrisvor, could you post an extract of a working Eeprom for thoose who don't have one please...

Thank you !

[alfiekino]

drummer,

first of all is to say thanks to you all who put in their time and effort in resolving this problem

so my question is... can you post the file of working wlan bit for us, without that i can't solve this problem... =(

[aleks_htctynt]

Thank you so much for this!!!!

I will try to reviving my X01HT WiFi later!

Great Job!!!!

[nicoebra]

Someone has repaired his hermes ??

[drummer10630]

Someone has repaired his hermes ??

I did. And so did Laikos. Actually, he fixed his about 20 minutes before I did, he is a better editor than I am. Why do you think we did the research? We both had devices with non-working wlans, and now they're working again.

...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.

[pop20032004]

It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.

Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.


I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...

[drummer10630]

I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...

How did you come to that conclusion?

All Laikos was suggesting, is you could type in the data, rather than replace the data by "cloning" it from another's device. Once you know the offsets, which you do if you read this technique, it's quite easy, although time consuming. So far, each file we have examined have had the identical wlan signatures, and identical first three numbers of the MAC address. That suggests that HTC was assigned a set of MAC addresses by OUI for their use.

BTW, using SPL 2.30 oli, you can change your backup CID, and model number (Hermes 100, 200, 300, or whatever you want to change it to like "Hermes 911").

[aleks_htctynt]

I believe that would be better than someone give the instructions detailed for those that they do not have other device to the hand to extract the EEPROM, extract your corrupt EEPROM and edit it.

In my case, live in Mexico city and these devices are extremely rare of seeing by here.

As soon as if someone can help me to obtain the file of a EEPROM will be I thanked what is.

[Nakura]

Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).
i can't edit file " herm1.nb"
you can guide again or help me to edit my file.

[dr-jo]

Hello,
Is it normal that my file herm1.nb is rained large that 30Mo at the time of that creation, thank you.
-------------

Edit:I excuse myself I have to make an error the first handling, I succeeded in having the file herm1.nb has 256 Ko (262 ' 439 bytes).
If I do not modify the mac address that you it will occur on the other apparatus, thank you

[chrisvor]

...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.

@drummer10630: I do appreciate all your and Laikos efforts to solve this problem and to let the whole community know the method so everybody can fix their devices... however, the reason I asked if anybody could post the file was not a sign of "laziness", rather it is due to the lack of friends who have a TyTN or who want to void their warranty by flashing a non-official bootloader in order to "do me the favor" of extracting their eeprom data.

If any of you guys have extracted the eeprom and you have edited it to include your MAC address, could you please edit a COPY of this file, put "FF" in all the bytes of the MAC address (which is the only thing that "ties" this file to your purchased device and hence yourself), and post it here for us "tytn-friend-less" people to use?

Many thanks for EVERYBODY's efforts in solving this :)
Thanks and kudos go to Pof and Oli ofcourse, due to whom none of this would be ever possible !! :)

Chris

[jrp]

I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got


USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000


... and no dump.

Is there a workaround?

[chrisvor]

I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got


USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000


... and no dump.

Is there a workaround?

According to the #1 post, you HAVE TO follow the instructions, i.e. downgrading to SPL 1.04, 1.01 MFG, Olipro 2.30, in order to save the eprom from the working device.... no shortcut I'm afraid :)

[dr-jo]

I removed the lines 00000000-00000140
But I do not have information with the line 0001F850 and 0001F860 is this normal? , thank you.

http://img341.imageshack.us/img341/5027/capture01ck8.jpg

[chrisvor]

Quick question.... Could I dump the WLAN eeprom from a Wizard? Dont think so, but I thought I'd ask since I have a wizard lying around too....

[Nakura]

can you present by picture ?
thank!

[drummer10630]

@chrisvor and jrp...don't get confused. The downgrade is from HardSPL, to 1.10 Oli, to SPL 1.04. You use 1.01 MFG on the device with the non-working wlan as it will allow the lnb command for flashing.

@nakura...I looked at your file, and it's not a correct dump. Please re-read and follow the instructions EXACTLY.

@dr-jo...When you loaded your file into your Hex editor, did you see the words HTCS at the beginning of the file (offset 00000140), and HTCE at the end of the file (offset 00040150) in the right column? You are basically supposed to delete the data before HTCS (including the word HTCS) and delete the data from the end of the file thru the word HTCE (including the word HTCE). (note:after you delete the data before 00000140, HTCE will be at offset 00040000). And yes, you MUST edit the MAC address to a new one.

[Korpse]

Would it be possible for someone to extract the eeprom file from a working wlan device, "zero-out" the MAC address portion, or replace with 'FF' or some other 'dummy' value, and post this here, so those of us without access to a working device can use to flash our damaged devices?

By "blanking-out" the MAC address in the attached file, you dont risk having your MAC address used by everybody, so there is no "legal" risk, and help us without a working device to fix ours...

Thanks for the solution guys and hopefully you can post the file here for us to use

Please do, My WiFi is stuffed to and I'm in a country town and nobody has a working Hermes I can use :(

[pop20032004]

How did you come to that conclusion?

All Laikos was suggesting, is you could type in the data, rather than replace the data by "cloning" it from another's device. Once you know the offsets, which you do if you read this technique, it's quite easy, although time consuming. So far, each file we have examined have had the identical wlan signatures, and identical first three numbers of the MAC address. That suggests that HTC was assigned a set of MAC addresses by OUI for their use.

BTW, using SPL 2.30 oli, you can change your backup CID, and model number (Hermes 100, 200, 300, or whatever you want to change it to like "Hermes 911").

Hi Drummer,

I had this conclusion from the reading i did about the cause of this problem. It has been said that this location (WLAN EEPROM) has been accidentally overwritten by and unlocking/update process. This means that this overwriting process will not target the MAC address location only, but it should blindly affect other locations. I have seen some posts that people seeing a lot of zeros of FF in that location instead of normal signature...

Another question for you if you may allow me, i have a problem in entering the bootloader mode. I press the power + side [OK] key, and press with stylus in soft reset button, but the X01HT continue to boot windows!! any idea what i shall do?

[drummer10630]

Hi Drummer,

I had this conclusion from the reading i did about the cause of this problem. It has been said that this location (WLAN EEPROM) has been accidentally overwritten by and unlocking/update process. This means that this overwriting process will not target the MAC address location only, but it should blindly affect other locations. I have seen some posts that people seeing a lot of zeros of FF in that location instead of normal signature...

Another question for you if you may allow me, i have a problem in entering the bootloader mode. I press the power + side [OK] key, and press with stylus in soft reset button, but the X01HT continue to boot windows!! any idea what i shall do?


I understand. The corruption or erasure of the MAC eeprom section of the nand, as reported by users, has come from rom or radio flashing (and unlocking via radio flash). Not from MTTY or PuTTY commands, as previously, before using SPL 2.30 Oli, users did not have access to and could not write to that part of the nand. If users follow the instructions exactly, then the ONLY data they are altering, is the MAC section, and since theirs are not working anyway, then there is no additional risk to their devices.

As for your other issue, make sure you press OK first, and then the Power button and press reset with the stylus, and hold down the OK and Power buttons until you reach the bootloader screen. If that doesn't work, I'm not sure what the problem could be.

[jrp]

@chrisvor and jrp...don't get confused. The downgrade is from HardSPL, to 1.10 Oli, to SPL 1.04. You use 1.01 MFG on the device with the non-working wlan as it will allow the lnb command for flashing.

I have SPL 1.04 already. Is the Oli 1.04 different, or can I go straight from 1.04 to 1.01 MFG?

[drummer10630]

I have SPL 1.04 already. Is the Oli 1.04 different, or can I go straight from 1.04 to 1.01 MFG?

There is no such thing as Oli 1.04. If you have SPL 1.04 it's RETAIL SPL 1.04, and that was clearly spelled out on the MrVanx downgrade page, even in graphics. Be sure to read the requirements and instructions regarding SPL 1.01 MFG before flashing...

http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG

[Busstop]

I have followed the instructions for preparing the herm1.nb; however, I wasn't able to write the file to the phone using MTTY. It said failed to synchronize with the device. I have put the file in the same folder as the mtty. What could be the problem? is there any different between the commands set 1e 1 and set 1 e 1? One part have a space between 1 and e , one doesn't , just wondering if it makes any difference.. Thanks

[panzer]

I have followed the instructions for preparing the herm1.nb; however, I wasn't able to write the file to the phone using MTTY. It said failed to synchronize with the device. I have put the file in the same folder as the mtty. What could be the problem? is there any different between the commands set 1e 1 and set 1 e 1? One part have a space between 1 and e , one doesn't , just wondering if it makes any difference.. Thanks

should be set 1e 1 (no space bet. 1 and e)

[drummer10630]

Sorry, post edited now...

[chrisvor]

** I LOVE YOU GUYS **

:) :)

My WLAN works !!!!!!!!!!

** THANK YOU THANK YOU THANK YOU ** :) :)

I'm a very happy Hermes owner. This community absolutely ROCKS !!!!

Edit: Drummer, is there any disadvantage if I flash 2.30 compared to HardSPL v7 (2.10 oli) ?

[belu]

@chrisvor Can you send me you wland nand and explaine me how can i change the mac ? Please

[Busstop]

should be set 1e 1 (no space bet. 1 and e)

Thank you for clarifying that. I was finally able to download the herm1.nb to the phone. I think I did something wrong before and the phone was stucked in bootloader mode after several unsuccessful attempt. I reset it by using the command "set 14 1" and flash the SPL1.01 MFG again. And I use an other version of mtty.exe that comes with the SPL1.01MFG pack. Now. my wlan is working again.. SOOO SOOO MANY THANKs to you guys for the great work!!!

Vincent
I think I will attach the herm1.nb file I used here, it's abit confusing what to delete according to the guide. I change the mac address randomly so I guess U can use it if you want to try.. good luck.

[belu]

Yeeeeeeesss !!! All work fine !!!! Thank everybody help me

[chrisvor]

Yeeeeeeesss !!! All work fine !!!! Thank everybody help me

Good work mate ;)

[drummer10630]

** I LOVE YOU GUYS **

:) :)

My WLAN works !!!!!!!!!!

** THANK YOU THANK YOU THANK YOU ** :) :)

I'm a very happy Hermes owner. This community absolutely ROCKS !!!!

Edit: Drummer, is there any disadvantage if I flash 2.30 compared to HardSPL v7 (2.10 oli) ?

Chris....no, they are identical bootloaders, except that 2.30 gives you the extra access to the nand.

[somatom]

Needed tools:



Steps for Non-working Wlan Device:

Using the methods on MrVanx's downgrading SPL page...

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

...downgrade again to SPL 1.04, then flash SPL 1.01 MFG.

http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG

Read the full instructions before flashing.

Ok, now that you have verified that you have SPL 1.01 MFG on the device, put in bootloader mode, disable USB connections in Active Sync. Connect the device and open MTTY. Make sure you have copied your herm1.nb file into the same folder as MTTY.

Connect to the device (\\.\WCEUSBSH001)
and hit ENTER to get a CMD prompt

Now type the following:

task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000

Hitting ENTER after each command.

When it's done, close MTTY and reboot your device and verify that your Wlan is now working...

Then I recommend flashing HardSPL v7 or SPL 2.30 to your device right away (because you know you won't leave your device alone and we don't want you bricking your Hermes, do we?)

BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:

plink HERMES > full.nb (hit ENTER twice)
task 32 (hit ENTER once and only once from now on after every command)
password 0000000000000000
set 1e 1
rbmc me.txt 50000000 7fff800

watch your file grow to 128 MB.

If you ever need to flash the entire eeprom nand, just edit it as above so you take out the commands you typed (HTCS-HTCE) and you're good to go...

Thanks go out to Pof and Olipro for doing the initial research on this issue. And also to members Laikos and Panzer who helped tremendously.

Tested on Cingular 8525 Wm6 VP3G modified AT&T rom, and Orange m3100 WM6 cooked rom based on Dopod 3.54.707.3 rom.


***DISCLAIMER.....TRY AT YOUR OWN RISK, WE ARE NOT RESPONSIBLE FOR ANY MALFUNCTIONS OR OTHER ISSUES THAT MAY OCCUR.***

what i can;t understand is that how to copy your herm1.nb file into the same folder as MTTY and where to be copied in.

[aleks_htctynt]

Thanks so much!!!! its great!!!!

Relly thank so much drummer, pof and olipro for this!!!

This forum is fantastic!!! I'm learning so much to my device!!! :D

[Korpse]

I will attach the herm1.nb file I used

Thank you so much :D

[drummer10630]

what i can;t understand is that how to copy your herm1.nb file into the same folder as MTTY and where to be copied in.


Well, your MTTY program is on your computer, IN some folder, right? So copy the herm1.nb file to that same folder. Still don't understand?

DO THIS:

Right click on MTTY and hit COPY, then right click on your desktop, and hit PASTE, then right click on your herm1.nb file and hit COPY and then right click on your desktop and hit PASTE. Now they are both in the same folder...It doesn't have to be the desktop, it can be ANY folder, it's just an example.

[somatom]

Well, your MTTY program is on your computer, IN some folder, right? So copy the herm1.nb file to that same folder. Still don't understand?

DO THIS:

Right click on MTTY and hit COPY, then right click on your desktop, and hit PASTE, then right click on your herm1.nb file and hit COPY and then right click on your desktop and hit PASTE. Now they are both in the same folder...It doesn't have to be the desktop, it can be ANY folder, it's just an example.

Thank you very much!!! I have solved this question,finally my device wlan is working now,I love xda and the guys which help me too much.

[Korpse]

So the file Busstop attached is ready to flash? all I do is change the MAC in it?
Thanks :)

[cjchriscj]

Can someone please email me a eeprom flash file? I don't have anyone in my area with a working device, my email is batosi@snet.net. It would be much apreciated, thanks, and I will definatley change the mac adress, i think i have my old one written down somewhere, and if i cant find it i'll just use one from an old computer im using

[drummer10630]

Guys, download the herm1b.zip file that was posted by Busstop in post #33. Unzip it, then open it in any Hex editor. In offset 0001F850 you will see FF FF FF.

AT 0001F85C, D and E replace those bytes with your own "invented" data in this format (going from left to right):

number/letter
number/number
letter/number

Save it, and flash it

[cjchriscj]

Guys, download the herm1.nb file that was posted by Busstop. Open it in any Hex editor. In offset 0001F850 you will see FF FF FF.

AT 0001F85C, D and E replace those bytes with your own "invented" data in this format (going from left to right):

number/letter
number/number
letter/number

Save it, and flash it

ok, i didn't see the file, but i got it from another post, is there a free hex editor that anyone recommends?

[LANDOS]

Thank you for clarifying that. I was finally able to download the herm1.nb to the phone. I think I did something wrong before and the phone was stucked in bootloader mode after several unsuccessful attempt. I reset it by using the command "set 14 1" and flash the SPL1.01 MFG again. And I use an other version of mtty.exe that comes with the SPL1.01MFG pack. Now. my wlan is working again.. SOOO SOOO MANY THANKs to you guys for the great work!!!

Vincent
I think I will attach the herm1.nb file I used here, it's abit confusing what to delete according to the guide. I change the mac address randomly so I guess U can use it if you want to try.. good luck.



HELLO . I CAN HAVE HERM1.NB . THANK YOU

[LANDOS]

i can have herm1.nb ???

[Busstop]

So the file Busstop attached is ready to flash? all I do is change the MAC in it?
Thanks :)

Yes..that's the file I used on my phone. U can just follow the instruction to download it to your phone using mtty.

[cjchriscj]

Thankyou to all of those who made this possible, i finally got my wifi back, after months of not having it!!

[pop20032004]

As for your other issue, make sure you press OK first, and then the Power button and press reset with the stylus, and hold down the OK and Power buttons until you reach the bootloader screen. If that doesn't work, I'm not sure what the problem could be.

Hi Drummer, I still have this strange issue... Can you help me to enter this bootloader screen using a command line the same way as the loaders are doing? or you can just point me to where to start :)


Thx in advance

[drummer10630]

Hi Drummer, I still have this strange issue... Can you help me to enter this bootloader screen using a command line the same way as the loaders are doing? or you can just point me to where to start :)


Thx in advance

Sorry, I don't know how to do that. I would start another thread in this section about it...

[inder]

i would like to change whole mac address, if i want use pocket pc for connection to Access point where is mac table defined fixed it is neccessary.

Best Regards
Kamil

[pop20032004]

Sorry, I don't know how to do that. I would start another thread in this section about it...

Just for sharing info with others, i did enter to the bootloader by executing the file /Windows/enterbl.exe

[pop20032004]

BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:

plink HERMES > full.nb (hit ENTER twice)
task 32 (hit ENTER once and only once from now on after every command)
password 0000000000000000
set 1e 1
rbmc me.txt 50000000 7fff800

watch your file grow to 128 MB.

Hi,

Is it safe to copy the entire 128MB Flash from a working HERMES to another one having some problems? Both are exactly same model & brand (X01HT)

Thx

[nicoebra]

IT WORKS !!!!
thank you guys !!!

[drummer10630]

Hi,

Is it safe to copy the entire 128MB Flash from a working HERMES to another one having some problems? Both are exactly same model & brand (X01HT)

Thx

I haven't done it so I don't have a definitive answer for you. I'm only guessing here, but "in theory" you could download the nand from the "problem" unit, and then if you flash it with the file from the "working" unit, and there were other issues, you could restore it from the backup? But I have no idea whether or not it would brick the "problem" device. What problems are you having?

[drummer10630]

i would like to change whole mac address, if i want use pocket pc for connection to Access point where is mac table defined fixed it is neccessary.

Best Regards
Kamil

Please post your question in another more appropriate thread and kindly use SEARCH first. This thread is related to units with non-working wlan due to corrupt or erased eeprom. I suggest you look in the networking forum of this site.

[pop20032004]

I haven't done it so I don't have a definitive answer for you. I'm only guessing here, but "in theory" you could download the nand from the "problem" unit, and then if you flash it with the file from the "working" unit, and there were other issues, you could restore it from the backup? But I have no idea whether or not it would brick the "problem" device. What problems are you having?

Hi Drummer,

I'm having dead WLAN + dead UMTS reception (other devices work in same area so it is not signal reception).

Also, I'm having a problem in loading SPL 1.01MFG... When i followed the steps at http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG the mtty or putty stuck at "start NB image download", and after a while (more than 30 min) i do a lot of [Enter] and it gives me "Fail to synchronize with the host (2)"

Also have tried to convert the .nb files of "SPL-1.01MFG_Pack.zip" from olipro to .nbh and used it with RUUWrapper.exe without success... Any hint about this issue would be appreciated.


USB>
USB>info 2
HTCSSuperCIDHTCEUSB>
USB>
USB>task 32
Level = 0
USB>lnbs spl-1.01.nbs 50020000
:F=spl-1.01.nbs
:A=50020000
:O=00000000
:L=FFFFFFFF

start NB image download
Fail to synchronize with the host (2)
USB>

[drummer10630]

Hi Drummer,

I'm having dead WLAN + dead UMTS reception (other devices work in same area so it is not signal reception).

Also, I'm having a problem in loading SPL 1.01MFG... When i followed the steps at http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG the mtty or putty stuck at "start NB image download", and after a while (more than 30 min) i do a lot of [Enter] and it gives me "Fail to synchronize with the host (2)"

Also have tried to convert the .nb files of "SPL-1.01MFG_Pack.zip" from olipro to .nbh and used it with RUUWrapper.exe without success... Any hint about this issue would be appreciated.

Looks like you didn't downgrade to SPL 1.04 before trying to get SPL 1.01 MFG on your phone. That's the only thing I can see from the information you've provided. Read this:

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

You'll see this on the page:

The downgrade will take the following steps, since HardSPL does not allow itself to be downgraded directly

[UpToBD]

Greetings!

I've been trying to fix my hermes, and have sucessfully downgraded to SPL1.04. But I can't then upgrade to 1.01MFG. When I type task 32, I get "Level = FF" as a response. If I try the lnbs command I just get a "Command error !!!" message.

Any help is *much* appreciated, as I have no idea what to do.

Thanks in advance!

[drummer10630]

Greetings!

I've been trying to fix my hermes, and have sucessfully downgraded to SPL1.04. But I can't then upgrade to 1.01MFG. When I type task 32, I get "Level = FF" as a response. If I try the lnbs command I just get a "Command error !!!" message.

Any help is *much* appreciated, as I have no idea what to do.

Thanks in advance!

Level=FF means not Super CID

Like it says in the MFG read me file:

1) Device _must_ be SuperCID first

[pop20032004]

Looks like you didn't downgrade to SPL 1.04 before trying to get SPL 1.01 MFG on your phone.

Hi drummer,

I'm sure that I'm SPL1.04 now. I did tried this many times from different PCs without success... Any Hints on how to solve SPL1.01 upgrade problem?

Thx for every one...


USB>info 2
HTCSSuperCIDHTCEUSB>
USB>info 7

HTC Integrated Re-Flash Utility, Common Base Version : 1.50a
Device Name: H, Bootloader Version : 1.04
Built at: May 26 2006 20:17:35
Copyright (c) 1998-2006 High Tech Computer Corporation

CPU ID=0x41129200
Main CPLD version=0x5
Upper CPLD version=0x4
Main Board version=0x6

USB>
USB>task 32
Level = 0
USB>lnbs spl-1.01.nbs 50020000
:F=spl-1.01.nbs
:A=50020000
:O=00000000
:L=FFFFFFFF

start NB image download
Fail to synchronize with the host (2)
USB>
USB>
USB>lnbs c:\SPL-1.01.nbs 50020000
:F=c:\SPL-1.01.nbs
:A=50020000
:O=00000000
:L=FFFFFFFF

start NB image download

[drummer10630]

@pop20032004...the only things I can tell you to check are:

1. make sure you are using the version of MTTY that comes with the MFG pack (some users can only get it to work this way)
2. make sure the MFG SPL-1.01.nbs file is in the same folder as MTTY

[pop20032004]

@pop20032004...the only things I can tell you to check are:

1. make sure you are using the version of MTTY that comes with the MFG pack (some users can only get it to work this way)


Y E S

This was the problem... I got my wlan LIFE again....



Many thanks drummer for your assistance :)

[UpToBD]

Hi Drummer. Thanks for taking the time to help me out.

I didn't know what supercid was (actually, I still don't) and thought that meant the phone was booted in the red/green/blue screen... my apologies.

Could I bother once more? How do I go superCID? I searched for it, and got a million hits talking about it but could not spot one article on how to actually do it.

Thanks again.

[UpToBD]

Hi Drummer. Me again.

Just found out what SuperCID is. I got my phone from T-Mob and after a few months asked them to unlock it. So far so good - I have used it on other networks. But it seems they removed the network lock without going superCID. Is there anything I can do about this?

I would love to get the wifi going again...

thanks in advance

[Impossible]

Drummer, seams like your tinkering in irc payed off!

Just followed your guide and I have got my wifi back.

THANK YOU VERY MUCH.

Imp

[drummer10630]

Hi Drummer. Me again.

Just found out what SuperCID is. I got my phone from T-Mob and after a few months asked them to unlock it. So far so good - I have used it on other networks. But it seems they removed the network lock without going superCID. Is there anything I can do about this?

I would love to get the wifi going again...

thanks in advance

One way is to pay the folks at www.imei-check.com

[UpToBD]

Hi Drummer

After much digging (and almost loosing it... turn out mtty only works properly from 1 out of the 4 usb ports I have - go figure...) I got it all working.

Thanks again!

[perico1362]

Thank you very much for this solution !!!! Great job!

Thank you !:) :)

[adamoc]

where I found this tool?and how can I have the nb file?

[drummer10630]

where I found this tool?and how can I have the nb file?


Ummm, did you READ this thread?

[adamoc]

yes but i do'nt see any link for this tool

[drummer10630]

Read post number #1 of this thread. All the infomation you need is there. Can I ask if you are a native English speaker?

[adamoc]

Read post number #1 of this thread. All the infomation you need is there. Can I ask if you are a native English speaker?
i have a problem with firefox. i'm italian

[drummer10630]

ah comprendere. io parle Italiano un poco. provare tu Microsoft Internet Explorer v6 più alto.

[adamoc]

Ok now i found it..i have wlan not working and i downgrade to mfg. Now where i found the herm1.nb that function??

[drummer10630]

http://forum.xda-developers.com/showthread.php?t=322225&page=4
post #33, but you have to edit 3 numbers in that file where it currently has FF FF FF.

[adamoc]

http:/ /forum.xda-developers .com/showthread.php?t =322225&page=4
post #33, but you have to edit 3 numbers in that file where it currently has FF FF FF.

ok thanks...I edit with dutty program or mtty?

[adamoc]

thank you drummer after 6 month my wlan is back!!!!

[doubledeala]

hrmm... i changed the 3 numbers in the .nb file posted on here. and i loaded it on my hermes, everything seemed to go ok, i loaded into windows, and for the first time (in a while), there was a popup telling me that it detected some wireless networks. and so i chose to connect to my router,and it says connected,but it won't go to any websites, or none of the programs that require a data connection work. Any ideas? Was it pertinent to delete the00000000-00000140 values, as well as the values at the end of the file? My mac address is changed, but still no connection. Any help would be nice. thanks!


NEVERMIND!!! lol, i did some fooling around in the connections settings and it works!!! Thanks a bunch fellas!

[Huckleberry88]

Hi Drummer, great work of yours!

Any chance to have a similar approach for the Wizard?

It seems I am one of the few with a Wizard sharing same problems (another one the issue with miniSD card) with Hermes users.

The problems appeared after my Chinese provider changed the stock Chinese ROM to an generic Asia English ROM for me.

Cheers!

[drummer10630]

Hi Drummer, great work of yours!

Any chance to have a similar approach for the Wizard?

It seems I am one of the few with a Wizard sharing same problems (another one the issue with miniSD card) with Hermes users.

The problems appeared after my Chinese provider changed the stock Chinese ROM to an generic Asia English ROM for me.

Cheers!


Sorry, I don't own a Wizard, so I have no idea. You will need bootloader, and memory map details. Maybe ask the guys on the XDA-Devs IRC channel?

[shelay]

i tried this procedure having been reading this thread for the past 10 days over and over again. i was going to use my mates Brand new hermes to make my wlan work, but i got more than that. now my mates hermes is totally dead. it wouldnt even come on again.and still, my own phone still has a broken wlan. anyway, just wanted to ask aynone doing this to take proper precautions.
KUDOS to the guys that started this fixing wlan. please any help will be appreciated.otherwise, i have to cough out almost £300 to get my mate a new phone.

[Olipro]

just to point out guys;

to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary.

secondly... who leaked 2.30.Olipro

and finally; when I get back from holiday, I'll be creating a program to allow you to change your device's MAC Address within a program. it'll also include a backup and restore function. and include the added bonus of soft-loading 1.01MFG

[rsolomon]

and finally; when I get back from holiday, I'll be creating a program to allow you to change your device's MAC Address within a program. it'll also include a backup and restore function. and include the added bonus of soft-loading 1.01MFG

I'd say "Hero status!" but you've already achieved that, IMO. :D

That will be the ultimate MAC utility, looking forward to it!!!

Thanks in advance,
Richard

[Huckleberry88]

Sorry, I don't own a Wizard, so I have no idea. You will need bootloader, and memory map details. Maybe ask the guys on the XDA-Devs IRC channel?

Thanks for the reply, Drummer. I will follow your proposal.

I tried to check how many other Wizard users on this forum would have the same problem. It seems very few although all my colleagues with a Wizard running the English ROM have the same problem (in total 4 persons) so the provider did something wrong when flashing.

Cheers!

[Olipro]

So... I got bored, decided to start working on it now.

so far it can read the EEPROM from the bootloader, read the MAC from the file and write a MAC to the file, next is to cover re-flashing the file on, should be trivial to do.

With the initial release, I intend to include a recovery EEPROM with it, so if you have a blanked EEPROM and nobody to get one from, you'll be able to load it up, insert your own MAC address and flash it on - the restoration one will still have the TI ACX OUI value so it'll look like a legit MAC if you send the device in.

[drummer10630]

Olipro...just sent you a PM, one other thing we noticed, is that EVERY member's MAC we looked at had the exact same signature AND first three numbers in the MAC address. It must be the range of MAC's that OUI assigned to HTC.

[Dolphin7fr]

First, I'd like to thank You for those wonderfull informations !

I've got a "Orange SPV M3100" - (HERM100) that works perfectly but I wanted to make a backup of the wifi code just in case I get into trouble with it
I noticed the MAC adress wasn't at the same adress (maybe a difference between the HERM100 and the HERM200...)

here is a screen capture of a MAC adress (12:34:56:78:9A:BC)
http://img79.imageshack.us/img79/6642/aaaaaqa7.jpg

I wanted to know if the full backup of the eeprom nand contained the radio firmware ?
Just in case the radio goes out of order, is it a way to restore it ?

Thank's for your job ;o)

[Olipro]

I wanted to know if the full backup of the eeprom nand contained the radio firmware ?
Just in case the radio goes out of order, is it a way to restore it ?

Thank's for your job ;o)

no, the radio firmware exists separately on the radio itself.

[Dolphin7fr]

no, the radio firmware exists separately on the radio itself.

Thank You for your answer
A little more question about Your personnal release of SPL "SPL 2.30 Olipro"
Can we do as before withe the 2.10's release for flashing an OS:
http://img234.imageshack.us/img234/4088/210pi4.jpg
or is it different ?

In last, would You advice to downgrade to 2.10 using SSPL or is it better to stay in 2.30 ?

[Olipro]

Thank You for your answer
A little more question about Your personnal release of SPL "SPL 2.30 Olipro"
Can we do as before withe the 2.10's release for flashing an OS:
or is it different ?

In last, would You advice to downgrade to 2.10 using SSPL or is it better to stay in 2.30 ?

it makes no odds either way, and yes, that's the correct option.

[SilverBandit]

Many thanks for this post - I only received my Vario 2 on Tuesday and thought I screwed my WLAN up for ever when I upgraded the ROM.

[Korpse]

I finally got it to SPL 1.01 and i get Level = FF, when I did run pof's Sim Unlocker and CID unlocker before, but the hacked radio that came with that wouldn't flash, but the tool said sucess, so what do I do :(

[salamatali]

thank u man gooooooooooooooood job .
nice work

[Korpse]

I couln't get my device to superCID, so i got the 1.01.olipro MFG (Its CID unlocked :) ) and made an NBH of that with nbhgen and then flashed that and then used lnb and now my WiFi is working again, Thanks a million to drummer10630 for all the help, and thanks to busstop for uploading his herm1.nb, I couln't have fixed mine without it :D, but the most deserving person is Olipro, Without him I would have never suceeded.

[matthewx]

I can't get a workable hermens, can anyone post herm1.nb here?

Thank you,
Matt.

[matthewx]

OH ~ it works! Thanks Drummer and Busstop!!

[esmith]

I'm still having problems with this if someone could help me...

I did everything that I seem to understand and in mtty I get to the part when it comes up and says "start NB image download" and it just sits there and does nothing.... how long should it take??
I downloaded someones herm1.nb file in this topic but don't understand what I have to edit... I read what was wrote but I guess it's over my head... I really want to have my WiFi working again if someone could help.

I can connect to a wifi router and it can show as much as full signal but when I try to browse a web page it just says something like it cannot load because the connection was lost even though it has full signal.

[drummer10630]

If you can see a MAC addess in your WiFi settings and you can connect to a wifi router, then you don't need to use this procedure. You have a different problem...

[esmith]

Ok there is a MAC address so that means my phone is screwed?? :eek:

[rsolomon]

Ok there is a MAC address so that means my phone is screwed?? :eek:

No, it means this is NOT your problem, look elsewhere.

[ionutz6]

Just wanted to say thanks from all my heart for all the hard work all you guys have done here. I know it has been done by a whole lot of others, but it needs to be said again: THANKS A LOT!!!
I have had this problem with a TyTn that a guy from HTC official service asked me to help with. After a day (10-12 hours) of post reading and googling around, I am so very proud to say that I have fixed the WiFi dead issue according to your instructions.
I must say it didn't go as smooth as you described, drummer, but in the end it worked. For example, I didnt need to go to SPL 1.0.4 in order to go to SPL 1.0.1 MFG. On the contrary, after going to SPL 1.04, my device was no more CID unlock. I did the unlock with Hermes CID Unlock v3a and then managed to change SPL to 1.01 MFG. Maybe I misunderstood smth., doesnt matter, the fact is that it worked by taking the herm1b file from this post and editing the MAC address in hex.
GREAT!! Cant tell you how happy i am!!!
PS. I became very good friends with an engineer from HTC local authorised service. In case this relationship might help any of you guys with anything in terms of knowledge, sources, etc, please let me know: ionutz [at] pdamobile.ro.

[b2kel]

Hy everybody,
I had the same problem but with the wizard (orange m3000)
I would lik to know if this trick work with this machine, coz i really want to recover my wlan
thx

[drummer10630]

I don't own a Wizard so I have no way of telling you. You could try to RBMC the NAND on the Wizard and see what you see in a Hex Editor and compare it to the herm1.nb file posted earlier in this thread, but I am not familiar with it's bootloader(s), and if there are any available that let you read that section of the NAND and you will have to modify the method...

[aeayk]

Hi

where can i find HEX editor!
to use it to change the last 6 digits in MAC line instead of "FF FF FF" of Busstop post #33!

Thank you

[aeayk]

Hi

after downgrading to 1.01 and by using MFG MTTY, when I type the following:

task 32 ( i get level = FF)
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000
after hitting ENTER (i get Command error !!!)

please any known solution.

Thank you

[drummer10630]

After typing Task 32 (you hit enter) you should get Level=0. If you are getting Level=FF your device is not Super CID which is necessary for using this method.

[aeayk]

After typing Task 32 (you hit enter) you should get Level=0. If you are getting Level=FF your device is not Super CID which is necessary for using this method.
thank you very much for your reply.
now I have a super CID and I get Level = 0
however, when I write
lnb herm1.nb 500a0000 40000
after hitting ENTER (i still get Command error !!!)

one more thing, do you know why I keep lossing Super CID status after every attempt to to flash herm1.nb! and I loss Level = 0 and now I'm back to Level = FF for no obvious reason, to me at least ;)

Thank you

[aeayk]

nothing worked so I attempted to use the conversion to .NBH method, the device went totally dead, no power no nothing :(

any solutions!

thank you anyhow.

[markafreeman]

You could try this. I had a similar problem and it didn't work for me but you never know.

http://forum.xda-developers.com/showpost.php?p=1669811&postcount=17

[aeayk]

You could try this. I had a similar problem and it didn't work for me but you never know.

http://forum.xda-developers.com/showpost.php?p=1669811&postcount=17

Thank you very much, Unfortunately it did'nt work :(

Thanks

[drummer10630]

To those of you that ended up with dead devices due to flashing complications, you can send your units to the guys at www.imei-check.com and they can flash your device back to life for you using JTAG. Just email them...I had someone take mine over to the UK with him, and they did it same day as they received it.

[aeayk]

To those of you that ended up with dead devices due to flashing complications, you can send your units to the guys at www.imei-check.com and they can flash your device back to life for you using JTAG. Just email them...I had someone take mine over to the UK with him, and they did it same day as they received it.
The site you mentioned has no address to sent to or phone number to call!
so how can we use their services!

Thank you

[drummer10630]

unlocksupport@imei-check.co.uk

[ciorciotto]

Hi
I had the same problem (dead wifi after flashing original rom) but with the Trinity
this trick work with this machine?

Thank you

[drummer10630]

Frankly, if we KNEW if this procedure worked for Trinty, or Wizard or any other device, don't you think we would have posted that info? We have tested this only on the Hermes, and after several successful flashes by different users, are pleased it works as long as you follow the instructions EXACTLY. Pof or Olipro might be the ones to ask if this method could be applied to other devices. I suggest you post in those other more appropriate device specific forums and ask them...

[dan1967]

I have successfully changed device ID from HERM200 using the very well documented procedure. Congratulations.
I must say that I simplified the process by using SLP 2.60 Oli straight without the downgrade/upgrade thing.
Cheers,
dan

[drummer10630]

Thanks dan1967, I edited page one to show your results...

[topper.it]

Hi dan, as i wrote here (http://forum.xda-developers.com/showthread.php?t=339961&page=2) i've a problem with my model number, did you had a problem like mine?
I have a 2.10 olipro
In that case to change my model id back to normal i should do the following things:
1. extract SPL 2.60 Oli Hard SPL v9 Developer Edition with nbhtool.
2. create a nbh with the extracted file changing the model id to HHHHHHH.
3. upgrade my rom using custom RUU and selecting force SSPL.
4. crossfingers
5. edit of the Busstop file with my working wlan mac address
6. upload the file to my dev using mtty.
Is the procedure correct?
Thanks for your answer.

[dan1967]

I had no problem with id no and I do not understand what problem should u have with it;
I just changed it for fun. if u want to do it just follow the procedure as described in here very well by drummer.

--"edit"-- I read your other message; what you said should work.

[topper.it]

Ok thanks, i think i'll give a try when i have some spare time.
Thanks for all and thanks to all!!

[abar1969]

hello i have the same problem
wifi died on HERALD
can i self repair? are some link to herald wifi problem?
sorry for my english
my device is half died
i have updatet CANNONJANG
i still have 4.70 yang
cann`t sync
update only with SD
but WIFI must be running! device is 5 month old!


(never touch a running system)

[drummer10630]

Here is the correct forum for the Herald:

http://forum.xda-developers.com/forumdisplay.php?f=349

[abar1969]

;) hello drummer
my forum for herald have found, but i d´nt see nothing to be happy.
have you for me a better link to repair my problem? PLEASE?
sorry for my english. i am Italian and live in germany 20 years, and i am 38 years old. i thank you for any answer.
ciao

[thycpt737]

Hi all, I've a prophet and wifi isnt working but i think a bit different situation from yours and you ideas... i think it was about 2 months ago my prophets wifi suddenly stopped working. after a hard reset of original jamin rom...than i've upgraded to many other roms and currently in wm6 and works perfect..but from that my wifi doesnt work... actually i can enable it and the led is blinking i can even see my MAC add at wlan settings and any other 3rd party programs such wifi companion...that gives me idea that iğt should noe be a hardware problem or beacuse of a erased eeprom. but my wifi doesnt searches for any signals and if i create it it tries to connect for 1 sec and nothing happens..i've tired all the radio roms and 3rd party wifi software...nothing changes the icon appears the led is blinking i can see the MAC of my device in the wlan settings bıt nothing happens.not even searches..need your ideas cause i love my phone and dont wanna change to a regular phone cause done have diff. now... thanx in advance.

[drummer10630]

Sorry about all you members with WiFi problems with your different devices. Please keep this thread ON TOPIC, as it is about the HTC Hermes. There are other forums for your devices, and one especially for networking issues. Please post your issues there, and reference this thread if need be...

[lbsportsdoc]

thank you very much for your reply.
now I have a super CID and I get Level = 0
however, when I write
lnb herm1.nb 500a0000 40000
after hitting ENTER (i still get Command error !!!)

one more thing, do you know why I keep lossing Super CID status after every attempt to to flash herm1.nb! and I loss Level = 0 and now I'm back to Level = FF for no obvious reason, to me at least ;)

Thank you
I think I have a similar problem. After flashing SPL 1.01 MFG I tried to go to the next step. I opened MTTY, I connected to the device indicated, but I'm not even sure if the CMD prompt is the same as the USB prompt but this is what I get:

USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.CMˆËHTCEUSB>set 1e 1
USB>Inb herm1.nb 500a0000 40000
Command error !!!
USB>

What do you think I am doing wrong? I feel like I'm almost there! :) Please help me out!

[HandN]

I think I have a similar problem. After flashing SPL 1.01 MFG I tried to go to the next step. I opened MTTY, I connected to the device indicated, but I'm not even sure if the CMD prompt is the same as the USB prompt but this is what I get:

USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.CMˆËHTCEUSB>set 1e 1
USB>Inb herm1.nb 500a0000 40000
Command error !!!
USB>

What do you think I am doing wrong? I feel like I'm almost there! :) Please help me out!

Read this http://forum.xda-developers.com/showthread.php?t=339961 I had the same problem and this is how I solved it.

[lbsportsdoc]

Read this http://forum.xda-developers.com/showthread.php?t=339961 I had the same problem and this is how I solved it.
Thanks for pointing me in the right direction. This is confirmation that I am close to my goal because Drummer has given me silimar advice. Only problem is I don't know how to "extract BL 2.60 from Hardspl V9 copied it to my device entered BL". If I don't get instructions on how to do this or what it even means I will be in for a loooooong evening of reading and research! LOL. I have a newborn and its so hard to put in the time that I need to put in to figure this out...and like many of you, I'm crippled without my Hermes! :)

Thanks again!

[markafreeman]

Run RUUWrapper.exe
When it says flash 2.60 click next
Now look in the folder that you ran RUUWrapper from and you will find EnterBootloader.exe and Rapitool.exe
Copy both these files somewhere safe and then cancel the rom upgrade.
Next copy both files to your device and run EnterBootloader on your device.
You should now see your device reboot and you will be in bootloader 2.60

Good luck

[seattleweb]

Any suggestions on how to get / replace the eerpom off of a Kaiser?

[lbsportsdoc]

Run RUUWrapper.exe
When it says flash 2.60 click next
Now look in the folder that you ran RUUWrapper from and you will find EnterBootloader.exe and Rapitool.exe
Copy both these files somewhere safe and then cancel the rom upgrade.
Next copy both files to your device and run EnterBootloader on your device.
You should now see your device reboot and you will be in bootloader 2.60

Good luck
Thanks. I still have no success. I have followed the directions and my wlan still is not working. How do I know where to go from here? Can I assume that since I do have SPL 1.01 MFG on my device (and even got the CMD prompt in MTTY), that I have done everything correct up to this point? Or do I need to start all over from scratch?

[drummer10630]

Any suggestions on how to get / replace the eerpom off of a Kaiser?

Please see post #128, thank you...

[lbsportsdoc]

Sweet success!!! It worked! Drummer you tha man! Thanks to the rest of you all for your patience with me and dealing with my questions! It felt great to know that I had the support from people at all ends of this planet! Thats amazing to me!!!

[seattleweb]

Please see post #128, thank you...

Sorry Drummer... not trying to hijack this thread, but the Kaiser thread is a dead end... this is one of two threads out of the 85 billion pages on the net that brush the surface :(

[drummer10630]

Sorry Drummer... not trying to hijack this thread, but the Kaiser thread is a dead end... this is one of two threads out of the 85 billion pages on the net that brush the surface :(

I understand. My advice is to send a very polite PM to Pof or Olipro as they were working on such a program previously. Or you can catch them on the XDA-Devs IRC chat channel. I think there are some guys in the Networking forum working on this as well...

[kaboos55]

Sweet success!!! It worked! Drummer you tha man! Thanks to the rest of you all for your patience with me and dealing with my questions! It felt great to know that I had the support from people at all ends of this planet! Thats amazing to me!!!

Hi man i have the same problem
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.CMˆEHTCEUSB>set 1e 1
USB>Inb herm1.nb 500a0000 40000
Command error !!!

so what u did to slove ur problem ? the quote#131 worked for you or what?

thank you in advanced :)

[markafreeman]

Hi man i have the same problem
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.CMˆEHTCEUSB>set 1e 1
USB>Inb herm1.nb 500a0000 40000
Command error !!!

so what u did to slove ur problem ? the quote#131 worked for you or what?

thank you in advanced :)

it should be lnb not Inb, try that.

[kaboos55]

thank you man it's lnb but notworking also

[drummer10630]

Just to clarify, are you typing lnb (small L)?

[HandN]

Hi kaboos55,
After trial and error this is what worked for me;
Copy the BL 2.60 olipro and rapitool to your device and install from your device rapitool. (read post #132)
Now enter BL by taping on ENTERBOOTLOADER.exe you should now see SPL 2.60 olipro
Now uncheck the USB box in active sync and connect your device to the usb cable open MTTY and klik on \\.\WCEUSBSH001 or USB on the right now hit enter to get the CMD> command (you will get CMD> instead f USB>) then type the following:
task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000 ( lnb is lower case "L")

After task 32 you should get LEVEL=0 if you get LEVEL=FF then you do not have supercid but if you have 2.60 olipro and you installed rapitool it should be good.
After password you get something like this HTCSSuperCID HTCEUSB> now type:
set 1e 1 hit enter and then start typing lnb herm1.nb 500a0000 40000 when you now hit enter you should get something like this:
:F=herm1.nb
:A=500a0000
:O=40000
:L=

start NB image download

I don’t remember what came after the :L= but then it will start downloading the image file herm1 this will take about a few sec. and your done.
Soft reset your device and your wlan should be working.
Remember to hit enter only once after each command you type.

For the rest of us I don`t want to be a smart ass but I found out that it is easy to look over small details.

Good luck.

[kaboos55]

oh thank you for your help ..thank all ...but i have a dead herm now ...just blank screen no error no light :( but thank you for your help anyway:)

[drummer10630]

Try this:

1.) Remove battery
2.) Connect Hermes to charger or USB
3.) Insert the battery while Hermes is connected to charger
4.) Red light should turn Amber
5.) Soft Reset

To those of you that ended up with dead devices due to flashing complications, you can send your units to the guys at www.imei-check.com and they can flash your device back to life for you using JTAG. Just email them...I had someone take mine over to the UK with him, and they did it same day as they received it. Email them at:
unlocksupport@imei-check.co.uk

[kaboos55]

thank you my friend for your advice :) ..but can anybody post the pinout of JTAG i mean TDO &TDI&TCK of herms ..maybe we can make "homemade" JTAG cable:) it's diffecult to me to send it to UK

[drummer10630]

thank you my friend for your advice :) ..but can anybody post the pinout of JTAG i mean TDO &TDI&TCK of herms ..maybe we can make "homemade" JTAG cable:) it's diffecult to me to send it to UK


Bro, if you had trouble flashing your EEPROM with this simple and effective method (that over 100 members have done successfully), then JTAG flashing is not something you should attempt. Thats being said, if you get the data on how to do it, send it to me.

[kaboos55]

Bro, if you had trouble flashing your EEPROM with this simple and effective method (that over 100 members have done successfully), then JTAG flashing is not something you should attempt. Thats being said, if you get the data on how to do it, send it to me.

well Jtag has 4 points to be tested in the device (TCK-TDI-TDO-TSM) i just want to know where are they in the herem (i was told that they are near the camera button in the bord....) so if you have any idea about where are the :rolleyes: please

[paul60]

I've upgraded my ROM to shapps 4.3.1 and now my WLAN is working but I can't connect to the internet. That, is I recieve an address from my router and the WLAN app says I'm connected but the icon on the main menu shows that it is still trying to connect. So I believe I may have a corrupt EEPROM and am following the instruction in this thread.

I'm try to use DUTTY'S Good .NB Tool but I don't know what to load-in for the different fields to create an a new NBH file.

Can any one identify what files should be loaded for each field or point me to a user guide?

Thanks

[drummer10630]

If the WiFi on your device shows a MAC address, then you don't have the EEPROM problem. The symptom is that WIFi never turns on, and you just get a spinning (wait) circle, then it stays off.

[paul60]

Yes, I do have a MAC address, which is registered with the router. I'll try to engage a different thread, since, as you said, the EEPROM is not the probem.

Thanks for the help!

[paul60]

Yes, I do have a MAC address, which is also registered with the router. I'll try to engage a different thread, since, as you said, the EEPROM is not the probem.

Thanks for the reply/help!

[ajagramonte]

Please, I unlock and upgrade my hermes via SD card and wlan dead.

My condition is very special. USB not recognize and not can use MTTY, no transfer data only charger, I sync only via bluetooth.

I have chance wlan live via sd card or other???

[ajagramonte]

just to point out guys;

to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary.

secondly... who leaked 2.30.Olipro

and finally; when I get back from holiday, I'll be creating a program to allow you to change your device's MAC Address within a program. it'll also include a backup and restore function. and include the added bonus of soft-loading 1.01MFG

I wait for this OLIPRO ........ post in this forum please..

[koorosh_bsboys]

I wait for this OLIPRO ........ post in this forum please..

Hey dude!
is it real???
SPL 2.30.olipro???
where can i find that?
please give me the url!:D

[drummer10630]

SPL 2.30, is in the XDA FTP folder Hermes/Hard_SPL/

[alakentu]

Hello everybody, I have tried every means to get the file and nothing herm1.nb, someone please give one that could serve as those who got the machine with WiFi in good condition are not good for use.

Please no longer do that, I need help.
Thanks in advance.

The file said get this:

USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMˆËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
:F=me.txt
:A=500A0000
:L=00040000
:rbmc=
USB>

Try to bring it to SUPERCID and it does, but when trying to connect to MTTY because no connection UBS, a connection gives CMD> that it does not accept the lnbs SPL-1.01.nbs.

It is not that most have.

Please someone help me with this.

[drummer10630]

The herm1.nb file has already been posted in this thread by member Busstop. Better re-read it again bro...

[alakentu]

The herm1.nb file has already been posted in this thread by member Busstop. Better re-read it again bro...

Thank you for your reply but I downloaded the file and I have reviewed with a hex editor and I do not see any side of the Offset of the MAC.

Check your file and tell me if this is correct.

[drummer10630]

Thank you for your reply but I downloaded the file and I have reviewed with a hex editor and I do not see any side of the Offset of the MAC.

Check your file and tell me if this is correct.

The MAC address is at row 0001F850 with two bytes at row 0001F860. The MAC reads backwards. I just looked at the file again, and it is correct as posted. Many members have used this file and successfully reflashed their devices following the instructions as written. Read carefully...

[alakentu]

Hello everyone and thank you for your answers drummer10630.

I downloaded the file you tell me, the device has a IPL 1.00 and the SPL is 1.04, I think there is all good, and I made the downgrade.

The switch in bootloader mode and turned off the USB connection with ActiveSync. Runs the MTTY connect and therefore does not say anything when I write task 32, and then tells me level = FF and then CMD>. Is SPL different? Besides I do not know how to carry SuperCID, because I have tried everything and still nothing.

How do I get it to enter USB> and is both SuperCID to enter the file brings me to 1.01-MFG. What am I doing wrong if I followed the steps completely.

It is not that most do. Answers?

[drummer10630]

Level=FF means your device is NOT super CID, there are many topics on how to do this. Use SEARCH and you will find them...

http://forum.xda-developers.com/showthread.php?t=293665

[alakentu]

Level=FF means your device is NOT super CID, there are many topics on how to do this. Use SEARCH and you will find them...

http://forum.xda-developers.com/showthread.php?t=293665

Ok,
Watch the log MTTY:
USB>lbns spl-1.01.nbs 50020000
Command error !!!
USB>info 2
HTCSSuperCIDHTCEUSB>password 0000000000000000
HTCSPass1.CMˆËHTCEUSB>info 2
HTCSSuperCIDHTCEUSB>task 32
Level = 0
USB>lnbs spl-1.01.nbs 50020000
:F=spl-1.01.nbs
:A=50020000
:O=00000000
:L=FFFFFFFF

start NB image download

And stays there and does nothing more.

If you use the link you say, I carried the SPL at 1.40 and then I can not use because MTTY does not recognize it, and if I downgrade to 1.04 ceases to be SuperCID, I do then?

Bootloader is:
HERM100
IPL-1.00
HERM100
SPL-1.04

[drummer10630]

....as much as I would like to answer all your questions, you need to READ the threads on this subject and use search. All the answers are there....

[alakentu]

....as much as I would like to answer all your questions, you need to READ the threads on this subject and use search. All the answers are there....

Thanks thousand thanks and more than a million thanks.

You were in the right, I was wrong, and not used another MTTY which comes in the package. Now if I have achieved. Super easy all this.

Many thanks.
Now I am going to develop the guide in Spanish.

1000 million thanks

[roundi]

Hello,

I have a dead Wlan on Artemis, how can I fix that ? can I use the files as the Hermes one (herm1.nb) ? If not, which one can I use?

Thank you!

[drummer10630]

No the hardware is different, and if you use it, you wil brick your device. Sorry bro, I have no idea how to fix your device. Did you try posting in the forum for Artemis or Networking?

[pablito]

Ho reinstallato la rom originale per trinity 1.23 con radio originale 1.38 ma il wifi non si attiva, nè dal comm manager nè da impostazioni>connessioni>wifi
mi è sparita la schermata delle reti disponibili...
ho letto nelle pagine precedenti di un problema simile per altro dispositivo HTC, mi sapresti indicare cosa fare o dove leggere per risolvere il problema sul trinity?
Tank you


I reinstalled the original rom 1.23 for trinity with radio original 1.38 wifi but not active, nor by the manager or by comm settings> connection> wifi
I have gone out of the available networks ...
I read in the preceding pages of a similar problem for other device HTC, I will indicate what to do or where to read to solve the problem on the trinity?
Tank you

HTC P3600 Trinity

[drummer10630]

Sorry bro, no idea what method to use for Trinity. Did you try posting in the Networking forum?

[ajagramonte]

OLIPRO I CONTINUOUS HOPING FOR THIS PROGRAM...
just to point out guys;
...
secondly... who leaked 2.30.Olipro
and finally; when I get back from holiday, I'll be creating a program to allow you to change your device's MAC Address within a program. it'll also include a backup and restore function. and include the added bonus of soft-loading 1.01MFG

[alarido]

I tried using downgrade to 1.01 MFG and 2.60 methods, used "herm1.nb" from post #33 modified hex from:

0001f850h: 00 00 01 0D 56 71 00 00 00 02 6D 54 FF FF FF 2D ; ....Vq....mTÿÿÿ-
0001f860h: 09 00 00 00 01 05 5A 64 00 00 00 01 09 5A 00 00 ; ......Zd.....Z..

To the following hex:

0001f850h: 00 00 01 0D 56 71 00 00 00 02 6D 54 6C 90 C3 2D ; ....Vq....mTl�Ã-
0001f860h: 09 00 00 00 01 05 5A 64 00 00 00 01 09 5A 00 00 ; ......Zd.....Z..

Upload from mtty works without any error, my device is SuperCID (I get "Level = 0" with "task 32" command) once flashed I reboot but wifi has no MAC and doesn't work, that is the result using Olipro 2.60:

Cmd>task 32
Level = 0

Cmd>password 0000000000000000
Pass.

HTCST ÚÈÒHTCEPassWord: 0000000000000000


Cmd>set 1e 1

Cmd>lnb herm1.nb 500a0000 40000
:F=herm1.nb
:A=500A0000
:O=00000000
:L=00040000

start NB image download
S
Load ADDR: 500A0000 Length: 40000
H**Code entry point at 0x500C0000


Cmd>


¿Any idea? maybe I missed something ¿?

[drummer10630]

In the .nb file provided by Busstop, the MAC reads Vq....mT...-
not Vq....mTÿÿÿ-
I have used Cygnus hex editor successfully, Some things to check:

Is your device a HERM100, or 200? Is your herm1.nb file located in the same folder as MTTY? Did you verify that you are using the version of MTTY that came with the MFG bootloader?

[alarido]

Thank you for your help.

My device is HERM200, herm1.nb was in the same folder as MTTY, and I tried MTTY from MFG bootloader and MTTY standalone both with the same results.

My hex editor is Ultraedit32 it has a different interpretation of hex data in ASCII, but hex appears to be the same, that is Cygnus read, no differences from Ultraedit:

0001F850 00 00 01 0D 56 71 00 00-00 02 6D 54 FF FF FF 2D ....Vq....mT...-
0001F860 09 00 00 00 01 05 5A 64-00 00 00 01 09 5A 00 00 ......Zd.....Z..

Anyway I'll try with Cygnus and post the results. Any other idea will be greatly apreciated.

Thank you.

[alarido]

No way, I tried now editing Bustop rom with Cygnus, but still without success.

Please someone can donate another ROM just in case, my terminal is a Vodafone v1605 from Vodafone Spain, please send me a PM or post it.

Thanks in advance :)

[alarido]

Problem fixed or at least problem found, some time ago I installed Forticlient Mobile once tested I unistalled it today I don't know why I remembered that more or less at this timewifi stopped working, now I reinstalled again and guess what, wifi come back then unintall again and wifi still there, I'm very happy :)

Thanks for your support which is greatly appreciated :)

[tapsystem]

Hi,

ok, i think my problem is this one, and i need to do this procedure to resolve it, but i need help and answers because my english is a bit poor and i'm a newbies in this king of procedure..so...

- flashing spl (downgrading), epprom does erase all the device, need i to re-flash rom and setup all software after that ?

- i've dl MTTY 1.42 and i can't find the 1.1 as writed in this thread...is it a problem or can i do process with this version ?

- i've dl herm1.nb in this thread, but i don't know wich software to use to edit it, and the bigger problem : i don't understand what i need to do in it and how to define a mac adress in this file...oh i've also see a file herm1.zip and another herm1b.zip, which one need i to use ?

Thanks for your help, give me as more details you can in a simple english or in french if somone can, because i really want to understand all steps before start and don't crash my device definitivly...:(

Great great tk's for your help...:o

TSyst.

[tapsystem]

Whaou, i m not so newbies than i was thinking :eek: , i've follow instruction read & read and finalys understood that files herm1b.zip was ready to flash, no data to change or else...so i make the big jump and try...asta la vista:rolleyes: ...

And evrything is alright, Wlan work fine thanks to evrybody who's making a post in this thread and so help me to do myself hack :cool:


Tks again

TSyst.

[pedicab28]

hello everybody,, pls help me,, i want downgrade SPL 1.11 to 1.04,
i try to download from http://www.mrvanx.org/thg/index.php?option=com_content&task=view&id=19&Itemid=27
but he's file can't work.. so give me link for SPL 1.04.
i waiting ur respons,, help me guys,,

[drummer10630]

I have never tried going from SPL 1.11 directly to SPL 1.04. I would suggest flashing HardSPL v7, THEN downgrading to Oli 1.10 then to SPL 1.04...

[lambda1976]

anybody can tell me if there's a similar procedure for the trinity?
anyway, this procedure can also be used with the trinity?

[dex_labs]

anyone knows how to do the same on herald? I'm sure it's the same problem because when I click on wifi it comes on for 1 sec and then goes away, and for that 1 sec I can see in the mac address mostly zeroes except for the last 4 chars, I tried forcing an IP and I see ctrl chars showing when I turn it on.

[tarrega78]

Dear all
Mine is Hermes ( Dopod 838 pro ) I was trying flashing for Chinese rom and stuck at the middle, after that I try to flash Original rom and it works . Nothings change except my usb connector doesn’t work for transferring or sync any data from PC to my Hermes unit. Yap all these day , I been follow all Upgraded Rom by using Micro SD flashing method , but once I am using a black satin II rom and suddenly my Wlan malfunction and don’t have any MAC address. I been read all thread they said it might work as long U follow the steps ( http://forum.xda-developers.com/showthread.php?t=322225) use Mtty software that indeed needed Works USB connector . I have no problem with Hex and flashing or Hard SPL either (using SD flashing method all works). my question is that possible ( of you guys that more expert ) created /solve my Dead Mac WLAN by using a micro SD flashing method like written some CAB that automatically can rewrite or fix Mac WLAN , or any trick that might works….. Please help me

Many thanx
ucok:(:(

[drummer10630]

I think someone could write a .bat file that could execute the procedure, but I'm not computer savvy enough to do it my self.

NOTE: users of Trinity and Herald please stop posting in this HERMES thread. Post in the appropriate forums...

[clarabell324]

Run RUUWrapper.exe
When it says flash 2.60 click next
Now look in the folder that you ran RUUWrapper from and you will find EnterBootloader.exe and Rapitool.exe
Copy both these files somewhere safe and then cancel the rom upgrade.
Next copy both files to your device and run EnterBootloader on your device.
You should now see your device reboot and you will be in bootloader 2.60

Good luck

Hi kaboos55,
After trial and error this is what worked for me;
Copy the BL 2.60 olipro and rapitool to your device and install from your device rapitool. (read post #132)
Now enter BL by taping on ENTERBOOTLOADER.exe you should now see SPL 2.60 olipro
Now uncheck the USB box in active sync and connect your device to the usb cable open MTTY and klik on \\.\WCEUSBSH001 or USB on the right now hit enter to get the CMD> command (you will get CMD> instead f USB>) then type the following:
task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000 ( lnb is lower case "L")

After task 32 you should get LEVEL=0 if you get LEVEL=FF then you do not have supercid but if you have 2.60 olipro and you installed rapitool it should be good.
After password you get something like this HTCSSuperCID HTCEUSB> now type:
set 1e 1 hit enter and then start typing lnb herm1.nb 500a0000 40000 when you now hit enter you should get something like this:
:F=herm1.nb
:A=500a0000
:O=40000
:L=

start NB image download

I don’t remember what came after the :L= but then it will start downloading the image file herm1 this will take about a few sec. and your done.
Soft reset your device and your wlan should be working.
Remember to hit enter only once after each command you type.

For the rest of us I don`t want to be a smart ass but I found out that it is easy to look over small details.

Good luck.

After following these post I get to BL SPL 2.60
enter mtty with the HERM1.nb file in same folder
clicked on \\.\WCEUSBSH001 to get CMD>

task 32 -returns- level=0

password 0000000000000000 -returns- Pass. HTCST 1UEGHTCEP password:0000000000000000

This differs from what is displayed above HTCSSuperCID HTCEUSB

Where am I going wrong here, if I go on to "set 1e 1" and " lnb herm1.nb 500a0000 40000" I get OS missing and Hermes 100 locks up. This is day 5 trying to fix this. Could it be that I am losing my USB connection when I go into MTTY. I am using the Herm1b.zip file that has already been edited with new MAC. Thanks for the help anyone.

Herm100
ATT 8525
ROM vp3G 3.62.3
radio 1.16.00.00
IPL 1.04
SPL 2.10 Olipro

I repeated the exact same process as above again and was successful. This confirms that the upgrade - downgrade is no longer needed to fix your WIFI/WLAN problem.

Thanks go out to all, especially you Drummer10630 who is still monitoring and supporting this thread.

[drummer10630]

Since you're getting an OS Missing error, let me ask, does your phone boot up and work normally, just with no WLAN?

Can you try the original method posted using downgrading of bootloader and post your results?

[playerd12]

Needed tools:

PuTTY ver.6 or above
Plink
Active Sync 4.5
any Hex editor
MTTY1.exe ver 1.11a
Windows PC
SPL 2.30 Olipro
SPL 1.01 MFG pack
SPL 1.10 Oli w/custom RUU
SPL 1.04 w/custom RUU
DUTTY'S Good .NB Tool
Win Rar
Hermes with working wlan

There are steps for the user with the device with the working wlan eeprom, and steps for the user with the device with the corrupted or missing wlan eeprom. Basically what you will be doing is cloning the MAC of a device with a working wlan, editing it, and flashing it to your device with the non-working wlan.

Steps for Working Wlan Device:

You need to get SPL Oli 2.30 (found on the XDA DEV FTP Site in the HERMES/HardSPL folder) on the working device. You can do this by following the downgrading bootloader page at:

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

Assuming you have HardSPL v7 on your device (as most of you have been doing upgrades and downgrades), follow the steps to downgrade to Oli 1.10 then to SPL 1.04, (read and execute carefully)

then use DUTTY'S Good .NB Tool...

http://forum.xda-developers.com/showthread.php?t=296311

...to convert the SPL Oli 2.30 .nb file contained in the .rar you downloaded (use WinRar to extact) to an .nbh file (RUU_signed) THEN flash SPL 2.30 (you can use the same custom RRUwrapper you used to flash to 1.04 by putting it in the same folder, but move the RUU_signed.nbh of 1.04 to another folder first, then put it back when your finished)


Download PuTTY and Plink and copy them into your C:\Windows\Temp folder

http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

Put your device in bootloader mode and disable USB connections in Active Sync


Connect to the PC and open PuTTY
Click SERIAL, and make the speed 115200, and type \\.\WCEUSBSH001 (all CAPS) in the space for SERIAL LINE (overwrite what is there) or connect with MTTY first...

http://forum.xda-developers.com/download.php?id=9864

... and copy and paste the address into PuTTY then close MTTY. Type HERMES into the space named SAVED SESSIONS and hit SAVE. Hit OPEN. Press ENTER to get a CMD prompt...you will see a green cursor. Type Task 32 and it will return Level=0. Ok, close PuTTY as you have verified that it's working.

Sometimes your device will be seen as \\.\WCEUSBSH002 or \\.\WCEUSBSH003, just use which ever it connects to.

Now the next bit is tricky because you you will do it "blind" as in this mode, Plink does not have local echo so you won't see what you're typing.

Go to START/RUN/CMD

This opens a DOS window. Change directories to C:\Temp and type the following:


plink HERMES > herm1.nb (hit ENTER TWICE) (you will see the new file herm1.nb written in your Temp folder) (notice the spaces before and after the > sign)

Now type the following and hit ENTER (once) after each command:

task 32
password 0000000000000000 (that's 16 zeros)
set 1e 1
rbmc me.txt 500a0000 40000

that will copy the wlan section of the eeprom nand to the file called herm1.nb. You can right click on the file, select properties, and see that it grows to 256k-257k.

When it's done creating the file (to 256k or 257k, you'll see it doesn't get any bigger), press CTRL C in DOS to close plink and it saves the file at 257k size.

Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).


Now, since you've basically cloned another's MAC address (already allocated to another device), it's necessary that you change your MAC address ASAP. Instructions on how to do that below:

In the edited herm1.nb file, go to the MAC Address at offset 0001F850 and change the 2nd, 3rd and 4th bytes from the right... (it's your MAC address in reverse), to ANY numbers you like, keeping the same format. This 6 byte sequence is your NEW MAC ADDRESS. The last 3 numbers of the MAC (which appear in opposite order) can be "invented".

You now have the eeprom flash file to be transfered to the non working device...


Steps for Non-working Wlan Device:

Using the methods on MrVanx's downgrading SPL page...

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

...downgrade again to SPL 1.04, then flash SPL 1.01 MFG. When flashing and using SPL 1.01 MFG, some users suggest you only use the version of MTTY that comes with the MFG Pack.

http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG

Read the full instructions before flashing.

Ok, now that you have verified that you have SPL 1.01 MFG on the device, put in bootloader mode, disable USB connections in Active Sync. Connect the device and open MTTY. Make sure you have copied your herm1.nb file into the same folder as MTTY.

Connect to the device (\\.\WCEUSBSH001)
and hit ENTER to get a CMD prompt

Now type the following:

task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000

Hitting ENTER after each command.

When it's done, close MTTY and reboot your device and verify that your Wlan is now working...

Then I recommend flashing HardSPL v7 or SPL 2.30 to your device right away (because you know you won't leave your device alone and we don't want you bricking your Hermes, do we?)

BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:

plink HERMES > full.nb (hit ENTER twice)
task 32 (hit ENTER once and only once from now on after every command)
password 0000000000000000
set 1e 1
rbmc me.txt 50000000 7fff800

watch your file grow to 128 MB.

If you ever need to flash the entire eeprom nand, just edit it as above so you take out the commands you typed (HTCS-HTCE) and you're good to go...

Thanks go out to Pof and Olipro for doing the initial research on this issue. And also to members Laikos and Panzer who helped tremendously.

Tested on Cingular 8525 Wm6 VP3G modified AT&T rom, and Orange m3100 WM6 cooked rom based on Dopod 3.54.707.3 rom.

*NOTE* Olipro just posted later in this thread

"just to point out guys;
to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary"

another member (dan1967) suggested that one only have to use SPL 2.60 Oli Hard SPL v9 Developer Edition to do this procedure and one can avoid the upgrading and downgrading of bootloaders...

Member alakentu has translated this method into Spanish. The thread is here:

http://forum.xda-developers.com/showthread.php?t=364751


***DISCLAIMER.....TRY AT YOUR OWN RISK, WE ARE NOT RESPONSIBLE FOR ANY MALFUNCTIONS OR OTHER ISSUES THAT MAY OCCUR.***

For those of you who used my guide to fixing your dead Wlan on Hermes, please feel free to make a donation via paypal if you feel I've helped you in some way. Any amount will be very much appreciated, and I could really use the cash, hee hee, thanks in advance. Just click the PayPal Logo below to donate.




this process is too long
try downloading proxy manager.cab from the internet.
open the program and disable proxy. this worked for me

[milesius]

this process is too long
try downloading proxy manager.cab from the internet.
open the program and disable proxy. this worked for me

so just disabling proxy will fix the MAC address problem? huh..

so...

I would try this if you gave just a wee bit more info, sounds much easier.

[drummer10630]

this process is too long
try downloading proxy manager.cab from the internet.
open the program and disable proxy. this worked for me

The process I wrote was long ago, when there were NO other solutions (check the post date). If your method works, please post some more info, especially that you had the NON working WLAN, zero MAC address, and it would not ENABLE...I would be quite happy if this simple method worked...excuse me if I sound skeptical, taking into account the number of posts you have made on XDA Devs.

[tonyroguez]

My problem was that the wifi didn't on, with the commented in the post #138 was solved 100*100
Thank you

[lyndel4]

Will this thing work on my HTC prophet? and body tryed it?

[passaretti1]

excuse me wi-fi on my htc p3600 don't work...what can i do ?

[lyndel4]

excuse me wi-fi on my htc p3600 don't work...what can i do ?

Well first of all tell us your problem in more detail then you can help what happeneds when u try to enable the wifi? does it come on or stays off? if so then u have to try the trick her and hope it helps but have u tryed hardreseting your device and flashing other roms to your device? if so then you should try that and let me know if that fix it also flashing different radio roms help other people try it ur self if none of them work try to see if ur device has a mac address if not try the trick if it does it must be hardware problem try to bring it for repairs but try the other things first becosue alot of the time its just software that corrupted the wifi function on your device hope you understand and hope it helps need more info reply back :)

its on the first page here is a link http://forum.xda-developers.com/showthread.php?t=322225

[passaretti1]

Well first of all tell us your problem in more detail then you can help what happeneds when u try to enable the wifi? does it come on or stays off? if so then u have to try the trick her and hope it helps but have u tryed hardreseting your device and flashing other roms to your device? if so then you should try that and let me know if that fix it also flashing different radio roms help other people try it ur self if none of them work try to see if ur device has a mac address if not try the trick if it does it must be hardware problem try to bring it for repairs but try the other things first becosue alot of the time its just software that corrupted the wifi function on your device hope you understand and hope it helps need more info reply back :)

its on the first page here is a link http://forum.xda-developers.com/showthread.php?t=322225

when i enable the wi-fi it remain off , i have try to flash with the radio and original rom but the problem is the same . how i can see if the device has a mac address ?
when i go in lan setting mac and ip are empty and in status : wireless LAN OFF . is a hardware problem ?????

[rocky_ofk]

when i enable the wi-fi it remain off , i have try to flash with the radio and original rom but the problem is the same . how i can see if the device has a mac address ?
when i go in lan setting mac and ip are empty and in status : wireless LAN OFF . is a hardware problem ?????


me too :mad:

[SuperSport]

Trinity P3600 WLAN issue FIXED by gruptnt.

Thanks to gruptnt over at this thread: http://forum.xda-developers.com/showthread.php?t=490681

WLAN IS NOW FIXED!!!!!! Flash without worry anymore.

[MiruK]

Can anybody help me with touch pro (raphael) ? the same problem with wifi:(

[ped_kho]

I have the same problem in HD2, this is the thread but still nobody answers:
http://forum.xda-developers.com/showthread.php?t=915320

also, some others have the same unsolved problem in Touch Pro and diamond:
http://forum.xda-developers.com/showthread.php?t=629302

[sepertimatahari]

it's work, thank you all