BenQ E72: collection of findings

---

Hi all,

...my recently bought BenQ E72 (candidate to replace my Tornado) has kept me busy and below is my findings-log (which most of them I could not find elsewhere, so they may be useful for you as well).
My device is intended for BT Fusion Service (which is no more offered) and this may explain the cheap price at Expansys.UK (I have not bought it from them, but from a different source in the UK offering refurbished ones).

Unfortunately my device was sent without a wired headset (which I am still struggeling to get). My investigations on the dual-use of the mini-USB are so far failing to decode the use of the wires. I suspect that (just like for the Motorola Razor V3) some active electronic parts are required in the headset to communicate with the mobile.

Cleanup \Windows folder:
- Remove locales not needed for MunduIM (fr, it, br, ...directories)
- \Data folder is for beetzRSS -> move to SD card in options menu
- \Java folder for JBED -> move to SD card, change keys in registry at (HKEY_CURRENT_USER\Software\JBlend)
- \Profiles folder for PIE -> move to SD card by changing paths at: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Shell Folders (may not be persistent if card is not ready at boot time or is removed)
- \Rings folder for ringtones -> also in \windows but are not referenced from there, so they stay here
- \skins folder is for HipCam (HKEY_LOCAL_MACHINE\Software\Emuzed Inc\HipCam)
- \sounds folder is for Camera sounds (HKEY_LOCAL_MACHINE\System\Pictures\Camera\OEM)
- \themes folder is for HipCam (HKEY_LOCAL_MACHINE\Software\Emuzed Inc\HipCam)
- \traveller folder for FIZZ Traveler
(move to SDCard, change items in HKEY_CURRENT_USER\Software\FizzSoftware\MicroClien t\TRS)

Ring tones selected from:
\windows\rings\*.*
\windows\ring*.* (no midi)

Install more than one T9 language:
- get packages from http://melgurth.ovh.org/index.php?page=downloads
- download also the package that you already have + the ones you want (so all have the same version)
- install them all, ignore device reboot requests in the meantime
- edit HKEY_LOCAL_MACHINE\T9 Input Method\MUI\Languages string "Available" to contain concatenated (separated by comma) all language numbers
- reboot device

Retrieve hidden settings/options in the setup menus by removing the commenting in the relevant XML files:
- callforwarding.cpl.xml get CFU settings for Data and Fax (Phone->Call Forwarding)
- clckalrm.cpl.xml get Automatic Timezone setting from Network (Clock&Alarm->TimeZone->AutoTimeZone)
- telephonygsm.cpl.xml get Frequencyband selection (Phone->Band Selection = usually "automatic")
- connectgsm.cpl.xml get SMS delivery options (Connections->SMS Service = usually "circuit only")

Info:
This device obviously is configured differently for several operators (see \windows\initflashfiles.dat).
Mentioned interesting strings are Orange, movistar, Flashlite, etc..
Intersting that the BT Fusion does not have an entry here.

Power Drain:
- batteryfunctions do not deliver drain and temperature, but the backup battery voltage is reported
Drain is (rough values):
- 60 mA Display visible
- 90 mA Lowest Light
- 110 mA more
- 120 mA normal
- 130 mA high
- 150 mA highest
BT creates peaks ~ 10 mA on top roughly once per second
WiFi creates peaks ~60 mA similar rate as above
- power off still drains the battery to charge the backup battery but only a few µA (micro Ampere)

Interesting Programs (not linked via .lnk files) in \windows:
- DevHealth.exe will also be called by LogMaster and creates a very elaborate memory and process report. It is named "mem_1.txt" and is either located in the Storage Card root or the main memory root, sized ~ 292kB. Subsequent calls will generate files named mem_<n>.txt where <n> relates to the called number. This file includes the DLL relationship of all active loaded modules, so it is easy for ROM cleaners to sort out the debug ROM remains.
-> This is the key application to investigate further any modifications of Startup options or ROM modifications.
- LogMaster.exe sets various trace and log points, can call netlogctl.exe, swmodemtrace.exe, celogflush.exe, DevHealth.exe, WinsockLogApp.exe, links to LogUtil.dll which relates to logfiles: OSImageVersion.txt, sqpco.log, sqmodem.log, sqdriver.log, sqatcmd.log)
- QDW.exe (internall referenced: "QDW.exe is launched by AppExceptionMonitor.exe", but this .exe is missing, only a dll is remaining) This would read (or write) to files in \Windows\System\ExceptionExtraLogs\. It calls copylog.exe to do the job.
If directly called it asks for a memory card and generates a directory \yyyymmdd_hhmmss\ExceptionExtraLogs\ generating (copying) files ELog.txt KITL.txt qatcmd.log qdriver.log qmodem.log qpco.log verinfo.txt call is hinished with "copy failed".
- PreForWSA.exe is called via HLKM\init\Launch.. and may prepare WinSockLogging (may call \Windows\WinsockLogApp.exe)
- prtscrn.exe generates a screendump of the current state, it is also called via long press of the Vol-Up key and generates a file called scncap<n>.jpg in the "\My Documents" folder (<n> is a sequence number starting at 1).

ToDo:
- remove UMAClient.exe from \HKLM\init\Launch.. but still keep WiFi switched off after reboot. UMAClient cares for the settings in Settings->Connections->WiFi transmission. If not loaded also the WiFi mode to disable WiFi if not connected after <time> does not work.

Candidates for ROM Cleanup:
- CeRegExport.exe (not a valid Windows CE application), executes on PC and links to rapi.dll to communicate with the device.
- D3DMDemo.exe (just displays a boiuncing ball and a rotating colored cube)
- D3DMPerf.exe (displays a colored cylinder, then quits)
- related dlls: D3DM_TI3D.dll, d3dm.dll (not referenced in mem_1.txt)
- AppExceptionMonitor.dll
...more to add here once ROM cooking will be possible

What do these programs do?
- ERS.exe (stays resident, links to coredll.dll only)
...

enjoy + enhance,

bye
tobbbie
:)

hi
thanks for your effort.
i'll study this report and compare with my e72 (by expansys, sim free and app locked, unlocked by utility found on the net)

can't edit the windows files

---

Thanks for the information. I have been trying to get access to the 'band' setting for some time. However I have been unable to edit the actual xml files. I have tried using SDA unlocker and RAPI and keep getting 'phone is unlockable'. How are you editing these files?

You cannot edit them onboard as they are in ROM. Copy them to your PC, remove the Read-Only attribute, edit and copy it back to the device. It will put in device memory and virtually overwrite the ROM copy. If you delete it on the device the old ROM copy will be used again.

Thanks. That is what I have been trying to do, but every time I get '...could not be placed on device. You do not have permission to create item'. It is like the file system is locked, but I cannot find a way to get past it. Any ideas?

Oh, yes you need to unlock it first. No clue how I did it, it is also not directly mentioned in my old blog. But from there are some links to other sites - you need to look it up there. It is basically the same thing that needs to be done on any WinMo device. Have you tried to search here already (use "E72 Unlock" as a start)?

Thanks. I was able to unlock the phone, copy the xml files off make the changes (removed the commenting), and copy them back to the device. However when I try to use a control panel function that relies on one of these xml files I get 'the control panel document telphonygsm.cpl.xml cannot be loaded. Verify the XML and try loading the control panel again.'

The XML is well formed (as best as I can tell), yet I get this every time I swap in the modified file I get this. If I put the original back in place everything is fine. It looks like the XML is bad, but I can't find anything wrong with it.

Ok, I think I figured it out. In the section that was commented out there were languages that were not relevant to what I had setup on the phone. Once I removed those it accepted the XML files and I was able to view the control panel. Thanks for your help.

Good stuff here. Bump up.

Has anyone found a way to change default hardkey mappings ?