FrankenKaiser SPL Loader

[jockyw2001]

May 24th, 2008

FrankenKaiser SPL Loader

This is a fast application image downloader which can download e.g. spl or android to the phone when the phone is in dload mode. This can for example be useful for developers to test a SPL from another device w/o the need to flash them :D

================================================== ====
DISCLAIMER: This method involves erasing SPL & OS and requires correct data entry by the user. I will not take any responsibility for any malfunctions and or damages caused by using this method and software.
================================================== ====

Prerequisites:
- a *security unlocked* HTC MSM7x00 device
- QC diag drivers installed (e.g. MotoQ)

This was tested with a Kaiser, Niki and Wings

Steps are:
1 power down
2 hold green send key and power on, the phone will enter radio bootloader (oemsbl)
3 connect with MTTY (COMn) and type "dload" to put phone in dload mode
4 close MTTY, reconnect USB, run my new downloader in a CMD box, e.g. "./FrankenKaiser-SPL-Loader.exe /dev/com4 SPL1.56-KAIS-unbricker.nb (substitute com4 by the com port of your qc diag driver)
5 hold send key and press soft reset with stylus (on phones like Nike this is not possible, in that case you must add "setboot 1" to step 3 before typing "dload" and in step 7 add "setboot 0" before typing "dload")
6 connect with MTTY (COMn) and type "mw 901708 1 e1a00000"
7 type "cego" (press and hold camera to enter tricolor bootloader mode)

Have fun!

[RizwanKhan]

may i be one of the first to say Thank you.

jumpspl, supercid and security unlocker, frankenkaiser .. man you are owesome.

A truly gifted individual and thank you for all your hardwork.

[arpy]

Thanks, Jockyw2000, your work really rocks, but...
OEMSPL did not work for me (HTC Wings)
Ive hold down the green button and tapped the PowerButton=>Boots normal.

Offtopic;
My Question is; Is it possible to "Switch" the GPIO 0x5c (Kaiser SimDoor) from 0 to 1 manually?
Because i want to "port" a KaiserRom over to my Wings, but ive getting trouble with this annoying "Sim Door Open, please close it.Phone shuts down in 10 seconds..." warning.:mad:

[jockyw2001]

Thanks, Jockyw2000, your work really rocks, but...
OEMSPL did not work for me (HTC Wings)
Ive hold down the green button and tapped the PowerButton=>Boots normal.

Your Wings is not security unlocked, so you can't enter oemsbl that way.


Offtopic;
My Question is; Is it possible to "Switch" the GPIO 0x5c (Kaiser SimDoor) from 0 to 1 manually?
Because i want to "port" a KaiserRom over to my Wings, but ive getting trouble with this annoying "Sim Door Open, please close it.Phone shuts down in 10 seconds..." warning.:mad:
Afaik that's possible.

[arpy]

Security Unlocked?!?

Ähh...ok...isnt enought to flash your HardSPL (http://forum.xda-developers.com/showthread.php?t=356295)?

...but youll give me some hope...now i digg deeper into this phantastic Forum...:eek:

[kyphur]

Just a quick question Jocky....

How does this differ from using MTTY to upload SPL to our Kaiser?

[jockyw2001]

How does this differ from using MTTY to upload SPL to our Kaiser?
How do you use MTTY to upload a SPL then ?

[kyphur]

How do you use MTTY to upload a SPL then ?

I'm asking with all due respect. I haven't done it. To be honest I haven't flashed anything with MTTY since I had my Hermes last year but I was under the impression that we could.

If we can't then you have answered my question as the difference is exactly that!

In the quest for knowledge we all sometimes ask apparently dumb questions...

[xmoo]

So with this thing I can make my deviece look as a MSM7500. To boot up HaReT all the time???

[cmonex]

I'm asking with all due respect. I haven't done it. To be honest I haven't flashed anything with MTTY since I had my Hermes last year but I was under the impression that we could.

If we can't then you have answered my question as the difference is exactly that!

In the quest for knowledge we all sometimes ask apparently dumb questions...


obviously you can, the RUU uses mtty commands to download the images.

[er1cc]

When I run FrankenKaiser-SPL-Loader.exe , WindowsXP closed DOS window with error.
What is wrong ?
WBR !

[er1cc]

Sorry, duble.

[fullarmor]

what's at address 901708 and why change it to E1 A0?

[gsmhackerns]

wait ....to resolve this .

[DaveShaw]

I use hard spl and install radio to unlock my htc tytn bat after this i flash with this rom :RUU_Kaiser_HTC_WWE_1.25.405.0_22.39.82.00.b_1.27. 04.15_Test

My phone complete all proces 100% bat after this can not boot or charge no ligh no bootloader as i can see now it have only radio bootloader (oemsbl) and i found and install driver and see in device menager com ports quacom diagnostic interface 6000 and qualcom nmea device...Can you help me to unbrick my kaiser with frankenkaiser spl loader i will donate with paypal you please...pm fuull instuction or can you create for me exe file with all .thanks.wait you.:confused:

Did you security unlock your device before this happened?

Ta
Dave

[gsmhackerns]

Did you security unlock your device before this happened?

Ta
Dave

i install hard spl unlock device bat after flash complete 100% my phone always go in oemspl can not go in normal bootloader or power on.

[pyraxiate]

Since it doesnt seem as though you unlocked the phone, just download an oem rom/radio combo for the phone from the operator it belongs on ( IE , if it is an ATT TILT, download from HTC the latest rom off their website JUST for the att tilt )

This should fix you up :)

[mobilend]

Did you security unlock your device before this happened?

Ta
Dave

Dave i have same prob...device allready unlocked before flash... no power on, no bootloader mode... on pc recognized like diagnostic.... what can i do?

[the0ne.john]

I managed to brick my device real good. When I start the device, holding down green send, and run mtty to run the dload command, I get Invalid command : dload. Im in deeper than I bargained for. Whats next?

[DaveShaw]

I managed to brick my device real good. When I start the device, holding down green send, and run mtty to run the dload command, I get Invalid command : dload. Im in deeper than I bargained for. Whats next?

What did you do? task 2a?
Are you security unlocked? What SPL do you have?

Thanks
Dave

[the0ne.john]

I have a KAIS130, SPL 1.0.olipof, task 2a. security unlocked.

[DaveShaw]

I have a KAIS130, SPL 1.0.olipof, task 2a. security unlocked.

Hmm, if you did a task 2a you probably no longer have an SPL ;)

Just use FrankenKaiser to restore the SPL. If you have a problem with it, post in that thread (I'm subscribed :))

Dave

[the0ne.john]

Thats exactly the problem. I cant get the kaiser into dload mode.

[DaveShaw]

Thats exactly the problem. I cant get the kaiser into dload mode.

Do you have the MotoQ drivers installed?
Does your phone make a "ding dong" sound when you put it in OEMSBL and connect it to your PC?

EDIT: Why did you do a task 2a in the first place?

Dave

[the0ne.john]

Do you have the MotoQ drivers installed?
Does your phone make a "ding dong" sound when you put it in OEMSBL and connect it to your PC?

EDIT: Why did you do a task 2a in the first place?

Dave

The phone does not make a dingdong sound, I am using the MotoQ drivers.

I task 2a'd because I am having extreme radio issues, when I (task 6?) I noticed I had many reversed blocks. I figured I would be able to reflash the SPL right after I task 2a'd but it stoped responding before I could reflash it. When I rebooted it I got a green status LED and no screen. When I plug the kaiser in, I get the 3 data devices.

[DaveShaw]

The phone does not make a dingdong sound, I am using the MotoQ drivers.

I task 2a'd because I am having extreme radio issues, when I (task 6?) I noticed I had many reversed blocks. I figured I would be able to reflash the SPL right after I task 2a'd but it stoped responding before I could reflash it. When I rebooted it I got a green status LED and no screen. When I plug the kaiser in, I get the 3 data devices.

I meant "PC", sorry.

I really arn't dure why your phone won't go into download mode. Maybe GSLEON3 or jocky2001 can help.

P.S. Merging this with the FrankenKaiser thread.

Dave.

[gsmactive]

This firmware provided on the front page does NOT work on NIKEs (dispite of what it says). However, the idea behind the process is sound.

Here is how you go about fixing a NIKI in OEMSBL.

1. Create a .nb from a NIKE hard SPL package. (for example hardspl-1.5mfg-nike). Use the NBHextract.exe to extract .nb from .nbh
2. Follow the procedure outline on the frontpage, but instead of SPL-1.56-KIAS-unbricker.nb, use the .nb created from step 1.

[Galileo911]

Hello how can i know if my pda is unlocked? I have the same kaiser of DaveShaw

[DaveShaw]

Hello how can i know if my pda is unlocked? I have the same kaiser of DaveShaw

What sort of unlocked?

So you can Flash ROMs?
-Put your phone in bootloader mode and tell me the SPL version.
So you can use SIMs from another network?
So you can use Franken Kaiser?
-http://forum.xda-developers.com/showpost.php?p=2590275&postcount=2

Unless you're phone is already bricked, in which case it may be too late.

Dave

[Galileo911]

In fact...my pda is bricked...i have used mtty and the task 2A. nOw the only think that my pda does when i press power on is a black screen and the green led. I have red all the post of the thread about task2A. Can i hope to save my pocket with franken kaiser?

[DaveShaw]

In fact...my pda is bricked...i have used mtty and the task 2A. nOw the only think that my pda do when i press power on is a black screen and the green led. I have red all the post of the thread about task2A. Can i hope to save my pocket with franken kaiser?

The you have no way of knowing if it's locked or not. Only way is to try, you've nothing to lose now :)

Dave

[Galileo911]

The you have no way of knowing if it's locked or not. Only way is to try, you've nothing to lose now :)

Dave

Sure? XD i was thinking the same think when i used task2A XD ok thank you very very very much. Only a question: what is send grey key? it's the botton over the botton with windows image? Sorry for my bad english...i'm italian :D

[DaveShaw]

Sure? XD i was thinking the same think when i used task2A XD ok thank you very very very much. Only a question: what is send grey key? it's the botton over the botton with windows image? Sorry for my bad english...i'm italian :D

The answer call button (I wondered that once upon a time as well ;)).

Good luck.

Dave

[Galileo911]

Thank you! i'm going to post what will happen

[Galileo911]

Nothing. PDa is not able to enter in radio boot mode :( and now?

[DaveShaw]

Nothing. PDa is not able to enter in radio boot mode :( and now?

Do you know what Radio you had? I'd PM jocky if you didn't have the "Radio from Hell" and see if he can help.

Dave

[Galileo911]

Do you know what Radio you had? I'd PM jocky if you didn't have the "Radio from Hell" and see if he can help.

Dave
i don't know it... the only thing that my pda do is to be detected by pc like a modem.

[Galileo911]

i don't know it... the only thing that my pda do is to be detected by pc like a modem.
I'm a noob XD

[Galileo911]

The last ROM that i tryed to install is TiR v8.

[Galileo911]

After 5 months in assistence they give my pda like 5 months ago!! bricked!! Please Help me :( what could i do now? :(

[xdasd]

Kaiser 130
HardSPL Olipof
radio 1.79.*

TiR19k wm6.5 working for 2 weeks. Turned off, on the next boot tricolor screen. Unsuccesfully tryed to flash both radio and rom via SD card (FAT32).

Unluckily found a post saying do Task 2A, done it, now phone is bricked in black screen + green led.

*****

Cmd>boot
boot$
Command error !!!

Cmd>task 32
task 32

Cmd>task 28
task 28
Format start
Fill RSVD information for block 288 to 309
Storage start sector=0xB700, total sector=0xFBC0
Storage start block=753, total block=1007
Total Bad Block in CE: 1

Erase physical block from 1042 to 2032

formatstorage Bad block found: 1385
si backup: Erase physical block from 2032 to 2048

Format end

Cmd>task 2A
task 2A
Format ALL start
backup SPL OK
backup MISC configuration OK
SPL start start block=288, total block of CE=1760
ERASE block 482 FAIL !!!
ERASE block 1097 FAIL !!!
Write 0xFF start page=0x4800, total page=0x1B800

SPL version and MFG TAG are same, skip it.
restore SPL OK
restore MISC configuratoin OK
restore MFG configuratoin OK
Format ALL end

Cmd>info 8
info 8

--- 2K bytes sector version ---

DEVICE NAME=samsung_k9k2g08
DEVICE ID=0xAA
DEVICE MAKER ID=0xEC
PAGE SIZE=0x800
TOTAL PAGE SIZE=0x840
BLOCK COUNT=0x800
BLOCK PAGE=0x40

Checking block information

BLOCK 482 (0x1E2) is bad block
BLOCK 1097 (0x449) is bad block
OS NOT FOUND !!!


Cmd>task 8
task 8

****

I've read a lot of posts regarding three color screen, task2A, Frankenkaiser. I've installed MotoQ drivers, phone is detected by winXP, drivers are properly installed (it's on COM4, 115200 bps). Phone is responding at some MTTY commands, like "setboot" "radata 9000000 1" (found in Frankenkaiser SPL1.56) but not at "dload" "echo_on" "mw ..."
I've tryied to flash like in "Radio Hell from Kaiser" but obviously stucked at step 6-7 because i've not this radio installed. So i tryied to follow this post, but i'm still stucked after doing Frankenkaiser command at prompt. It says it has correctly uploaded the SPL but when i replug or reset (holding green button) the phone, and load MTTY (1.42) and do "mw .." command, it says: "Invalid command : mw"

so, the phone seems to be bricked, but not broken :P
it answers at some commands, but im not able to complete any procedure to the end.

Any help or idea about how to solve it? Thanks a lot

***** EDIT *****

It seems like my kaiser is not unlocked, because http://forum.xda-developers.com/showthread.php?t=369754 it accept only the locked device commands
there is a way to let me know if it is locked or not? I buyed it few months ago with SIM unlocked and modified ROM - RADIO - HARDSPL installed, so i thought it was unlocked, but i did not unlocked it by myself so im not sure it was.. :(
damn i like Kaiser so much, i hope it could revive soon.. tnx for help again

[mharrissmith]

I have just flashed your ROM (M2D,85Mb,2G) and looks great! One thing, is there any way to have the option of snoozing an appointment for a certain period of time? It looks like is is set as default at 15min, sometimes I need to snooze them for 1 hour.
I know there are some CABs to fix this, but i want to know if you have tested any of them , because apparently many of them won´t work.
Thanks!

[DaveShaw]

I have just flashed your ROM (M2D,85Mb,2G) and looks great! One thing, is there any way to have the option of snoozing an appointment for a certain period of time? It looks like is is set as default at 15min, sometimes I need to snooze them for 1 hour.
I know there are some CABs to fix this, but i want to know if you have tested any of them , because apparently many of them won´t work.
Thanks!

Er, I think this is the wrong thread ;) :p.

Dave

[fernnanndo]

You are my last hope guys. I have some problems whith my Htc Cruise. I use the task 2a command and now its dead. But I have a last hope. Please can anyone help me or tell me wich command should i use in the MTTY to try revive my phone. I have tell you, my htc cruise do not power on and cant put it in boot loader mode. His screen is complete blank.
Im from Argentina, sorry for my bad english.

[eimor]

Will this tool help me? I have a Tilt, my radio is 1.71.09.01, i have HardSpl 3.29.Hard, the thing is i cannot get in bootloader mode, and the only thing i get to see is the splash screen where the radio and other stuff is displayed. and nothing else, activesync does not detect the usb connection, and not being able to get into bootloader leaves the gold card method out of the equation, please, help me!!!

[thebulletfromhell]

NO!!! For one thing, doing this for a noob will f*ck your device. Try hardreseting first

[nicke85]

Ok here is my problem..Before i did frankaiser for radio from hell..and have hard spl 3.34..after 6.5 rom i downgrade my kaiser to 6.1 and back to 6.0..and than try to flash the first test rom for kaiser 1.25.405.0 (radio 1.27.04.15) here is an old tread (http://forum.xda-developers.com/showthread.php?p=6625024#post6625024)
My phone answer at command dload at mtty and after run FrankenKaiser-SPL-Loader.exe answer on screen is correct but can't turn on the phone..

how to fix it!?:confused:

[nicke85]

I have installed Qmoto drivers..but when I press green poone button and connect to the PC then enter to mtty142 and type "dload"..
it makes without any echo on the screen because there is no abiliti to see what i type..my phone is dead!
after that reconect phone from the cable and than again connect and type

FrankenKaiser-SPL-Loader.exe /dev/com4 SPL1.56-KAIS-unbricker.nb


=== FrankenKaiser SPL Loader (c)2008 by jockyw2001
=== Donations happily accepted, paypal to jocky_wilson@hotmail.com

SPL file read, file size = 262144 bytes

Just be patient while I'm working ...
7e 02 6a d3 7e

Now:
1. hold send key and press soft reset
2. connect with MTTY (COMn) and type 'mw 901708 1 e1a00000'
3. type 'cego' (press and hold camera to enter tricolor bootloader mode)

seems that something is doied but what..7e 02 6a d3 7e is correct answer if device is alive but my kaiser is totaly dead..

Any help please!?!?!?