Interop-Unlock Lumia 800 plus bootloader and NAND access [Q&A]
Questions & Answers
- Added ROMs & updated Links and Q&A - 21/04/2012
- Updated Links - 16/04/2012
- Now is possible to downgrade Nokia bootloader to Qualcomm one on the Lumia 710 More Info - 15/04/2012
: I've a Lumia 800 or 710 can I Interop-Unlock it?
: The short answer is yes if you have a Lumia 710 - you must firstly downgrade your bootloader - and "maybe" for the Lumia 800, because only some of them can be Interop-Unlocked at the moment.
: I've got a Lumia 710 how can I downgrade my bootloader to the Qualcomm one?
: You must flash this firmware
with Nokia Care Suite (mirror splitted in two parts: Part1 Part2
: Cool how can I discover if I'm a lucky owner or not?
: For first go to "Settings
-> more info
" and if your "Hardware revision number" ends with 2.4
you are probably screwed out.
: I've got 2.4 hw rev how can I check eventually?
: You don't need to check if your hw rev is 2.4 and your Lumia came with firmware 11500 or higher you have the new nokia bootloader.
: I've got 2.3 hw rev how can I check if I'm eligible?
: If you've got hw rev 2.3 but you have flashed your device with a firmware 11500 or higher - flashed mean with Nokia Care Suite because Zune doesn't update your bootloader
- you have the new Nokia Bootloader; if you want eventually to check see below "check if my device is interop-unlockable".
: So at the moment which can be interop-unlocked?
: As for now can be interop-unlocked hw rev 2.3 with firmware version 11141 or below
: I've got the NOKIA DLOAD can I put the Qualcomm bootloader?
: Yes but ONLY
if you have a Lumia 710, on the 800 is not possible at the moment.
: Can I get the Qualcomm bootloader by downgrading my Lumia ?
: No, you can't flash the Qualcomm bootloader with a backup, as explained here
: I have interop-unlocked my Lumia but now I can't access Windows Live services!
: You can find your solution here
: I've got the NOKIA DLOAD how can I flash my device?
: You can ONLY
flash your device with Nokia Care Suite.
: I've got the Qualcomm bootloader how can I flash my device?
: You can ONLY
flash your device with Qualcomm QPST.
The Story so far: Nokia Interop-Unlock plus bootloader and NAND access
As many of you may have seen our beloved user biktor_gj
found firstly that some Lumia 800 and 700 have Qualcomm unlocked bootloader that expose the entire nand of the device as removable media and permit to read write it. This discover lead to make custom rom as you can easily write raw data back to the NAND with dd linux - or any unix like variant - with the modifications for gaining Interop-Unlock.
As for now we have a tested Lumia 800 Rom that lead us to a Interop-Unlocked Lumia 800, pay attention that the devices, as stated Heathcliff74 here
, is not fully rooted and need more patching.
Check if my device is Interop-Unlockable
- Shut down your device
- Hold pushed VOL + and POWER
- Plug into your USB, you will hear a short vibration
- If you are running Windows it will ask to format an USB drive, say no!
if you are running Linux you will se something like this:
[ 655.912077] usb 2-2: new high speed USB device number 9 using ehci_hcd
[ 661.797096] usb 2-2: USB disconnect, device number 9
[ 765.836050] usb 2-2: new high speed USB device number 10 using ehci_hcd
[ 765.968707] usb 2-2: config 1 has an invalid interface number: 20 but max is 1
[ 765.968713] usb 2-2: config 1 has no interface number 1
[ 766.869700] usbcore: registered new interface driver uas
[ 766.905673] Initializing USB Mass Storage driver...
[ 766.905816] scsi2 : usb-storage 2-2:1.20
[ 766.906108] usbcore: registered new interface driver usb-storage
[ 766.906110] USB Mass Storage support registered.
[ 767.906264] scsi 2:0:0:0: Direct-Access Qualcomm MMC Storage 2.31 PQ: 0 ANSI: 2
[ 767.964504] sd 2:0:0:0: Attached scsi generic sg2 type 0
[ 767.968542] sd 2:0:0:0: [sdb] 31047680 512-byte logical blocks: (15.8 GB/14.8 GiB)
[ 767.969066] sd 2:0:0:0: [sdb] Write Protect is off
[ 767.969069] sd 2:0:0:0: [sdb] Mode Sense: 0f 0e 00 00
[ 767.970061] sd 2:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 767.977005] sdb: sdb1 sdb2 sdb3 sdb4 < sdb5 sdb6 sdb7 sdb8 sdb9 >
[ 767.977264] sdb: p9 size 30632075 extends beyond EOD, enabling native capacity
[ 767.983196] sdb: sdb1 sdb2 sdb3 sdb4 < sdb5 sdb6 sdb7 sdb8 sdb9 >
[ 767.983463] sdb: p9 size 30632075 extends beyond EOD, truncated
[ 767.988075] sd 2:0:0:0: [sdb] Attached SCSI removable disk
then you can
Interop-Unlock your Lumia with one of the following ROM:
Lumia 800: Interop Unlock (no full unlock yet)
ROM based on: RM819_059P453_1600.2487.8107.12070_002
Mediafire folder access: http://www.mediafire.com/?kknt4lnc3tn7w
Lumia 710: Interop Unlock (no full unlock yet)
ROM Based on: RM803_059N2L6_1600.3015.8107.12070_010
Mediafire folder access: http://www.mediafire.com/?9z6og65ozgrnr
CAUTION: these images AREN'T TESTED. Use at your own risk.
PLEASE DO A FULL BACKUP OF THE NAND BEFORE PLAYING AROUND
if you want to flash this is the procedure on linux:
dd if=./os-new.nb of=/dev/sdX9
Where X is the disk detected by your linux distribution.
After that, you'll need to hard reset the phone
- Hold Power button for 10 seconds to exit Qualcomm's disk mode, and press and hold POWER+VOLUMEDOWN+CAMERA until you feel the phone vibrate.
- After that, RELEASE power button but KEEP HOLDING volume down + camera for five or more seconds.
This will trigger the hard reset.
If when you plug your device and you see NOKIA DLOAD for now your out of luck because your bootloader is locked and you can't flash the roms above.
Lumia 710 & 800 ROMs
ROM for Nokia Lumia 710
ROM for Nokia Lumia 800
Direct Link: http://xdafil.es/Lumia800/ROM/full-unlock-os-new.nb
Zipped Files: http://xdafil.es/Lumia800/ROM/Zipped
Qualcomm Disk layout
Completed the file uploads: http://www.mediafire.com/?kknt4lnc3tn7w
LUMIA 800 FLASH FILE SYSTEM LAYOUT:
- Dump_in_parts.part*.rar : Dump of the OS partition (IMGFS dump)
- Dumpmap-imgfsobjects.zip: logs and stuff from OSBuilder
- sd*.rar: compressed DD dumps of the rest of the filesystem
- NOT INCLUDED:
- Partition #5: contains product code and stuff from phone, 64kb
- Partition #4: Extended partition container for partitions 5-9
- Partition #9: Cannot post that enormous partition, 15Gb in size (but should be enough with the dumped os).
Partition Begin End Blocks ID
/dev/sdb1 * 1 1000 500 4d Initial Bootloader - SECBOOT
/dev/sdb2 1001 4000 1500 46 Second stage loader? - OSBL, also looks like it has the download mode and seems to init LCD, enable USB etc.
/dev/sdb3 4001 304000 150000 c W95 FAT32 (LBA) - Writable partition with EMMCBOOT, AMSS etc.
EMMCBoot is responsible for loading Windows Kernel (nk.exe). I got a copy of Samsung Galaxy i9001's emmcboot.mbn, and putted it in there. It tries to start, but seems to crash (expected). But hey! it tries to boot it (it even vibrates for 1/10 of a second), so getting something else (did anyone say...android?)running on this phone should be easier than in lots of other phones... Does anyone have u-boot ports for Qualcomm 8255?
/dev/sdb4 304001 31037579 15366789+ 5 Extended partition which holds the OS
/dev/sdb5 304006 304133 64 ef EFI (FAT-12/16/32) - Linux detects it as an EFI partition, but it's just 64Kb size, and seems to have some markers, not sure yet what it is, but could be anything from IMEI and simlock to an actual efi partiton for WinCE...
EDIT AGAIN: this partition contains phone serial number and product code, and possibly imei and simlock. For sure its not an efi partition
/dev/sdb6 304134 310277 3072 58 3Mb size
/dev/sdb7 393216 399359 3072 4a 3Mb size
/dev/sdb8 399360 405503 3072 4b 3Mb size
These three partitions have similar start and end data on their partitions, no idea what they are, since I haven't been able to see if it's even a file system. All the documentation I see seems to tell Windows Mobile uses exFAT for the filesystem, but can't seem to find its header anywhere on the flash... still looking. It could even be where WinMo stores application installers for first boot on the device (but could be perfectly wrong)
All of them start with the following header (hex):
7D 8D 27 82 D7 40 F8 90 53 22 82 43 6D EC 6F 69 49
/dev/sdb9 524288 31156362 15316037+ 48
This las partition is 15Gb size, and contains all the Operating System and all the data on the phone.
Anyone know about how does Windows Phone manage filesystems on NAND? Some help would be really appreciated...
The file system for the 15Gb partition has _wmstore header, still incompatible with some kitchens, but still looking...
Here's part of the header:
LK Bootloader for Lumia
setupped a git repo of LK Android bootloader for Lumia devices here
*** Compiling the LK Android bootloader ***
** Tested on Ubuntu 11.10 with Lumia 710 **
1) Get the toolchain and install:
sudo tar xvf arm-2009q1-203-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2 --directory /opt/
2) Compile the bootloader:
PATH=/opt/arm-2009q1/bin:$PATH TOOLCHAIN_PREFIX=arm-none-linux-gnueabi- PROJECT=msm7630_surf make EMMC_BOOT=1
3) Get your Lumia into diagnostics mode (turn it on using VOL UP + VOL DOWN + POWER)
4) BACKUP EVERY SINGLE FILE FROM THE 150MB PARTITION! (Just to be safe)
5) Replace the image/emmcboot.mbn file with your freshly compiled LK bootloader
cp <repo dir>/build-msm7630_surf/EMMCBOOT.MBN /media/<mount point>/image2/emmcboot.mbn
6) Unmount the bootloader partition from your PC and pull the phone's battery
7) Turn on, wait a few moments, and plug the phone to the PC
8) Test the fastboot connection:
fastboot getvar version
for now is working only the fastboot protocol but nothing more, is in current alpha stage.
For ANY NON TECHNICAL question please post here instead of posting into the dev thread.
- NAND access + InteropUnlock for Lumia 710 & 800 Dev Thread ONLY tech posts.
- Unlocks explained by Heathcliff74Here
- Qualcomm Product Support Tool (QPST™) 2.7 Here
- Nokia.WIndows.Phone.Test.Introduction: Here
- OSBuilder V 1.4.205 (16.04.2012) : Changelog & Download