DEV ONLY - NAND access + Full Unlock for Lumia 710 & 800

Search This thread

jessenic

Senior Member
Sep 9, 2010
479
315

Bph&co

Senior Member
Apr 14, 2012
110
101
Hi,

I asked in previous posts for people to hex edit the second partition(the bootloader),
but seems better not, unless you have a recovery method.

The first 710 that felt victim to unsolicited hex editing of the bootloader code:

Code:
Init connection...Done
Enter flash mode...Done
Enter bootloader mode...Done
Boot version:	0.0.0.1
------------------------------------------
Flash File:	RM803_12w07_prod_generic_nokia_osbl.esco
Sending certificate...Done.
Sending file...Failed(err: 0x30047).

Did comment out the cert checking functions, but forgot to set this flag:
Code:
ROM:04538458 1C 08 9F E5                 LDR     R0, =[B]unk_45DE83C[/B]
ROM:0453845C 00 00 D0 E5                 LDRB    R0, [R0]
ROM:04538460 00 00 50 E3                 CMP     R0, #0
ROM:04538464 8C 08 9F 05                 LDREQ   R0, =0x30047
ROM:04538468 7D 00 00 0A                 BEQ     bad_err

Hehe, now need to buy another phone.

I could not find an alternative restore method via test point, as suggested earlier
in the thread. The only possible pins for TP access could be GPIO35 or GPIO160
(not likely, seems WD dissable for JTAG access). Shorting to GND or Vcc will not
give different USB device.

JTAG seems to be alive, at least the RST and HOLD pins respond, did not check
actuall comm.

I am attaching the testpoints description, if somebody wants to push this further.

BR
 

Attachments

  • 710_tp.zip
    100.5 KB · Views: 148

biktor_gj

Senior Member
Jan 25, 2008
1,408
7,008
Ouch! You could have tried putting nokia's sbl on top of EMMCBOOT and boot it from there (difficult to press the key just in time but...) Does it still do something or is it dead dead?

LK Bootloader update: Well not much to update really, nothing I've done so far works... Even tried contacting the guy who wrote the panel kernel module for the n9 but I think he was fired from Nokia... or at least his mail address has disappeared (no such user). I have tried to force every gpio up, just to make it vibrate, or turn the led flash on or something but no luck so far... will keep on trying anyway :)

By the way, if someone's bored and wanting to look for datasheets, here's the panel: Samsung AMS391PJ01
 
Last edited:
  • Like
Reactions: jbbandos

deylo

Member
Apr 15, 2012
40
3
Hi,

I asked in previous posts for people to hex edit the second partition(the bootloader),
but seems better not, unless you have a recovery method.

The first 710 that felt victim to unsolicited hex editing of the bootloader code:

Code:
Init connection...Done
Enter flash mode...Done
Enter bootloader mode...Done
Boot version:	0.0.0.1
------------------------------------------
Flash File:	RM803_12w07_prod_generic_nokia_osbl.esco
Sending certificate...Done.
Sending file...Failed(err: 0x30047).


BR

well well well...im experiencing this same problem. i opened the second partition (starting at sector 1001) and replaced everything there onwards with the contents of a new osbl and wasnt able to flash with NCS nor NSS. if you get a resolution let me know. i am trying to work on one now. what i am trying to do is extract the osbl and replace the .mbn file in there with another. i did that and now when i tried to flash with NSS it didnt fail. however the other file to be flashed failed. there is where i am stuck at the moment
 

ultrashot

Inactive Recognized Developer
May 26, 2009
1,478
2,046
St.Petersburg
Ouch! You could have tried putting nokia's sbl on top of EMMCBOOT and boot it from there (difficult to press the key just in time but...) Does it still do something or is it dead dead?

LK Bootloader update: Well not much to update really, nothing I've done so far works... Even tried contacting the guy who wrote the panel kernel module for the n9 but I think he was fired from Nokia... or at least his mail address has disappeared (no such user). I have tried to force every gpio up, just to make it vibrate, or turn the led flash on or something but no luck so far... will keep on trying anyway :)

By the way, if someone's bored and wanting to look for datasheets, here's the panel: Samsung AMS391PJ01
Biktor, btw, my friend with Lumia 710 built a rom with full unlock and it worked. Probably you've just missed an OSBuilder's option about XIP on "Building - 2" tab.
 

Bph&co

Senior Member
Apr 14, 2012
110
101
Ouch! You could have tried putting nokia's sbl on top of EMMCBOOT and boot it from there (difficult to press the key just in time but...) Does it still do something or is it dead dead?

Hi,

The phone works fine, just not able to flash any file or replace the badly edited
loader.

Yes, i got the idea to include backup copy in the next partition, but too late now.

BR
 

biktor_gj

Senior Member
Jan 25, 2008
1,408
7,008
Biktor, btw, my friend with Lumia 710 built a rom with full unlock and it worked. Probably you've just missed an OSBuilder's option about XIP on "Building - 2" tab.

I'm pretty sure you're right :) I have yet to try your last advice and see if that at least works... but there's so much to do and have so little time (sbl unlock, make emmcboot actually boot something, build a kernel that also boots... ;)

I wish I would have at least haRet to retrieve memory maps and lcd on sequences.. it's a shame microsoft messed it all...

Will retry the full unlock for the 800 tomorrow, see what I can do!
 

Bph&co

Senior Member
Apr 14, 2012
110
101
well well well...im experiencing this same problem. i opened the second partition (starting at sector 1001) and replaced everything there onwards with the contents of a new osbl and wasnt able to flash with NCS nor NSS. if you get a resolution let me know. i am trying to work on one now. what i am trying to do is extract the osbl and replace the .mbn file in there with another. i did that and now when i tried to flash with NSS it didnt fail. however the other file to be flashed failed. there is where i am stuck at the moment

Hi,

When you extract the loader from the esco file and manually put in the partition -
all works fine after restart. Editing strings or not important code does not prevent
the loader from working - nothing is checked on the loader before it gets execution
anyway.

But i just did a bad edit. In your case - maybe you haven't cut the correct part
before inserting it.

BR
 

jessenic

Senior Member
Sep 9, 2010
479
315
By the way, if someone's bored and wanting to look for datasheets, here's the panel: Samsung AMS391PJ01

That is the N9 panel. Do they have the same panel in the Lumia 800? (I've always thought that they use a 854x480 for Lumia 800 too, as there are references to that resolution in the Lumia 800 firmware)
 

biktor_gj

Senior Member
Jan 25, 2008
1,408
7,008
That is the N9 panel. Do they have the same panel in the Lumia 800? (I've always thought that they use a 854x480 for Lumia 800 too, as there are references to that resolution in the Lumia 800 firmware)

Yeah user CareDood tell me he swapped them and they both worked, so I disassembled the lumia and checked it out. It seems the trick on the Lumia is they use the lower part of the display to make the stupid buttons glow. What a waste of screen.

The problem is there are no available list of gpios, and the n9 code is hardcoded for the omap DSS, so porting it over to an entirely different architecture isn't easy, at least for me... I can't even make the keys respond :( well maybe I can, but I have no way of debugging it without a screen...
 

jessenic

Senior Member
Sep 9, 2010
479
315
Yeah user CareDood tell me he swapped them and they both worked, so I disassembled the lumia and checked it out. It seems the trick on the Lumia is they use the lower part of the display to make the stupid buttons glow. What a waste of screen.

The problem is there are no available list of gpios, and the n9 code is hardcoded for the omap DSS, so porting it over to an entirely different architecture isn't easy, at least for me... I can't even make the keys respond :( well maybe I can, but I have no way of debugging it without a screen...

I'd like to see an image of N9 screen an a Lumia booted into WP7 :p But if you manage to get those things working, you would need to rewrite for Lumia 710 (different panel), right? And currently only 710 bootloader can be downgraded.
 

biktor_gj

Senior Member
Jan 25, 2008
1,408
7,008
I'd like to see an image of N9 screen an a Lumia booted into WP7 :p But if you manage to get those things working, you would need to rewrite for Lumia 710 (different panel), right? And currently only 710 bootloader can be downgraded.

Unofrtunately I haven't got a 710 to try...
The first thing would be to check if the Lumia 710 can boot the LK bootloader with the lcd type set to MDDI (by default is set to spi). I have some memory corruption or some other kind of fault in there, but samsung's lcd doesn't seem to have much in common with other types of lcds.

It would be nice to know if it's a Toshiba or a Sharp panel, it would be easier to fix the lcd since half of the code is already written...
 

deylo

Member
Apr 15, 2012
40
3
Hi,

When you extract the loader from the esco file and manually put in the partition -
all works fine after restart. Editing strings or not important code does not prevent
the loader from working - nothing is checked on the loader before it gets execution
anyway.

But i just did a bad edit. In your case - maybe you haven't cut the correct part
before inserting it.

BR

hhmm im a bit lost. what do you suggest be done? because im getting the same error as you. have you found a solution to your problem?
 

beidl

Senior Member
Apr 30, 2009
467
217
Vienna
fredl.me
Yup, the 710 has got a different panel. It would be really great if someone could find out which panel it has, because I've tried some things which turned out not to work.
 

jessenic

Senior Member
Sep 9, 2010
479
315
Unofrtunately I haven't got a 710 to try...
The first thing would be to check if the Lumia 710 can boot the LK bootloader with the lcd type set to MDDI (by default is set to spi). I have some memory corruption or some other kind of fault in there, but samsung's lcd doesn't seem to have much in common with other types of lcds.

It would be nice to know if it's a Toshiba or a Sharp panel, it would be easier to fix the lcd since half of the code is already written...

No idea if this helps, but this is on the back of the 710 screen:
 

biktor_gj

Senior Member
Jan 25, 2008
1,408
7,008
Hey guys, how can I check if my phone is fully unlocked?

@ultrashot: it finally booted!

Sent from my GT-I9100 using XDA
 

biktor_gj

Senior Member
Jan 25, 2008
1,408
7,008
Install Root Tools and try to set some app's (like XapHandler) policy to trusted.

It says device incompatible, just like before... the rom has all the packages from ultrashot, sideloading works, but touchxplorer doesnt show any folder (like with interop)... so thats a no? Or simply the app refuses to work?

Sent from my GT-I9100 using XDA
 

Top Liked Posts

  • There are no posts matching your filters.
  • 81
    UPDATE: First custom rom with Interop Unlock flashed succesfully. Requires hard reset after installing and an unlocked bootloader. See post for proof:
    http://xdaforums.com/showpost.php?p=24818275&postcount=242
    BIG THANK YOU TO ULTRASHOT!
    Without you I couldn't have done it!
    NOTICE: Testing full unlock (XIP unlock etc) with ultrashot. Will post new files as soon as I get a working build which doesn't get stucked on boot ;)

    Disclaimer:
    I AM NOT RESPONSIBLE IF YOU LOOSE DATA, BREAK YOUR PHONE, OR SET YOUR HOUSE ON FIRE. DO THIS AT YOUR OWN RISK. BTW, REQUIRES A HARD RESET SO YOU WILL LOOSE ALL THE DATA IN YOUR PHONE BY FLASHING THIS. IF UNSURE, DON'T DO IT.
    PLEASE STOP PM'ING ME FOR HELP, I CAN'T REPLY 20 PMS/HR. Please use the forum, maybe someone can create a discussion topic to help others and leave this for links and development. Thank you very much!

    PLEASE STOP SENDING ME PMS ASKING FOR HELP AND USE THE DEDICATED THREAD
    THIS THREAD IS FOR DEVELOPMENT ONLY, PLEASE RESPECT THAT AND USE THE Q&A THREAD FOR YOUR QUESTIONS.
    LINKS:
    Lumia 800: Full Unlock
    New firmware: May 16, 2012 (removed foursquare and stuff)
    sdb3.rar: Flash it to PARTITION #3. It contains 12070's amss & adsp. Not absolutely required but if you have an older version this should give you better battery life.
    http://www.mediafire.com/?kwjladlgvq81rha
    OS-NEW:
    As always, flash it to PARTITION #9.
    Part1: http://www.mediafire.com/?21by2oj7acnhkhw
    Part2: http://www.mediafire.com/?wkeduvp9l4199qh
    Part3: http://www.mediafire.com/?cnbkms40dy4y06z
    Part4: http://www.mediafire.com/?rabunpmnaqclq3o
    Complete Mediafire folder access: http://www.mediafire.com/?uo2dqcl34b9cy
    ___________________
    Alternate ROM with Full Unlock + Some apps:
    Part1: http://www.mediafire.com/?8gnqm418v32im3e
    Part2: http://www.mediafire.com/?bgtg2t5infrnua1
    Part3: http://www.mediafire.com/?l0sl5hbr0v9gfi1
    Part4: http://www.mediafire.com/?emt2dfswdhn0z0w
    Apps preinstalled:
    DS Supertool
    File Deployer
    Metro Theme
    WebServer
    WinTT
    WM Device Center
    WP7 Root Tool

    ___________________
    Lumia 710: Interop Unlock (no full unlock yet)
    ROM Based on: RM803_059N2L6_1600.3015.8107.12070_010
    Mediafire folder access: http://www.mediafire.com/?9z6og65ozgrnr
    http://www.mediafire.com/download.php?d3bj3dkfbffbakn
    http://www.mediafire.com/download.php?l35zjaebdrsm315
    http://www.mediafire.com/download.php?ys5bapu8ubezybo
    http://www.mediafire.com/download.php?tnadd4uuoxhatv3
    CAUTION: I don't have a 710, so these images AREN'T TESTED. Use at your own risk. Be careful, people are reporting problems with this rom.
    Full Unlock Image for Lumia 710 by lucifer3006 -BE CAREFUL, IT HAS BUGS, FOR TESTING PURPOSES ONLY- (thanks ultrashot & lucifer3006): http://www.mediafire.com/?p3318y5l19abb

    You have a mirror of all the stuff on mediafire on xdafil.es: http://xdafil.es
    Thank you mousey_!

    PLEASE DO A FULL BACKUP OF THE NAND BEFORE PLAYING AROUND.
    If you are developing fixes for the bootloader 'problem', feel free to grab a copy of the rest of partitions and stuff I posted over this thread here: http://www.mediafire.com/?kknt4lnc3tn7w


    INSTRUCTIONS:
    Requires an unlocked bootloader (a.k.a. qualcomm development bootloader).
    Easy to check: Turn the phone OFF, then press and hold VOLUME UP + POWER until you notice a short vibration. Plug in to the computer. If the phone turns up in disk mode (USB Mass Storage Device), then you have an unlocked bootloader. IF you're in Windows, it will ask if you want to format the disk. SAY NO OR IT WILL EXPLODE (it won't explode but you might break it)
    If the device detected by the computer is Nokia DLOAD you have a locked bootloader and you're out of luck, at least for now.

    I used 'dd' in Linux, I guess you can do it with Windows version too (http://www.chrysocome.net/dd) but it's more involved to find the appropiate partition:
    dd if=./os-new.nb of=/dev/sdX9
    Where X is the disk detected by your linux distribution.
    After that, you'll need to hard reset the phone. Hold Power button for 10 seconds to exit Qualcomm's disk mode, and press and hold POWER+VOLUMEDOWN+CAMERA until you feel the phone vibrate. After that, RELEASE power button but KEEP HOLDING volume down + camera for five or more seconds. This will trigger the hard reset.

    Now time to play with bootloaders and try to get this to work for everyone!

    If you like my work and want to donate for a beer (or two), follow this link
    22
    I'd suggest renaming on of the colors. Would be great if it was possible to interop the phone without losing data.

    Well, you can always make a backup and then restore via zune. The thing is the dumped OS is about 600Mb, the generated image is 378Mb. I don't know how it will reside on the flash, you could always check where the flash starts to get filled with zeros and clean it up before the first boot... If they had done it right and separated user data from the main OS we wouldn't have this problem...

    INTEROP UNLOCK ACHIEVED!

    Now time for a nice beeer ;)
    I'll put mediafire to work and upload the image I just did. Everyone who has an unlocked bootloader: after you flash this to the phone, DO A HARD RESET, otherwise it will get stucked on 'Installing Applications'
    12
    Hey everyone,

    I was hoping to be able to crack Nokia's osbl, but time already run out and wasn't able to get it. So sorry, guys, but I had to return both Lumias. It's been a fun month, and at least I helped getting custom roms for at least some of you.

    I'll be uploading here all the files I have on my computer so anyone can mirror them or use them for whatever you might need. If I can help you with something else (development related please) feel free to drop me a PM.

    Once again big thank you to Ultrashot, Beidl, Xsacha, cdbase, ceesheim, HeathCliff & everyone that helped out with this. Now back to my (almost) forgotten Galaxy S2 & to try Boot 2 Gecko and see what progress has been done since the last time I checked :)
    8
    Btw, here is my DppImplant app.
    Implants DPP partition with your stock Live Id to a custom rom.
    Usage:
    1) Put backup of the biggest partition to the folder with DppImplant.exe and call it "stock.nb"
    2) Put "os-new.nb" there - target firmware in which you want to see your old Live Id.
    3) Open DppImplant.exe. It will extract DPP from stock.nb and create mydpp.bin file. (After that you won't really need to have stock.nb in that folder).
    "os-new.nb" will be patched.
    4) Done.

    P.S. if you open DPP using Notepad or any hex editor, you'll see saved Live Id.
    6
    Ok L710 fully unlocked :)
    Those 2 parts are wrong. I used to narod.ru

    ---------- Post added at 07:29 PM ---------- Previous post was at 06:40 PM ----------
    http://www.youtube.com/watch?v=-rQbFp7yasc


    CAN WE KEEP THIS FOR DEVELOPMENT ONLY PLEEEEEEEEEEEEEASSSEEEEE?

    Gift from our friends at Qualcomm:

    Full AMSS firmware + Secboot Sources (Qualcomm loader)! Grab it while it's hot!

    http://www.mediafire.com/?ir2h15f663ja6wc