C6602 LTE unlock test

SquallATF · Apr 1, 2015

Here is a unlock test baseband
1. Try it at your own risk
2.before you flash it, backup your TA first, you can use Backup TA or flashtool 'Advanced->Trim Area->Backup'
3.You need to use my modified version flashtool to flash it
4.flash modified baseband ftf and reboot will get it work
5.SO-02E can not flash this ftf. If you flashed will LOST SINGLE, if you did not backup your TA can use this fix to restore single.
This change is permanent, you only need to flash it once.
c6602's LTE possible work with band 1 5 8, because of different power amplifier IC other bands may not work or work poor .
c6602 pcb

c6603 pcb

The pcb is same but power amplifier chip in the left area is different
If you want to restore baseband configuration, you can restore TA first and flash the baseband file but exclude TA.

If you have C6603 or SO-02E, I wish you dump TA and send to me to complete unlock.
in NV/TA-log, I found first time init baseband, it will read all item from TA partition 1, such as rfnv files, and baseband config
by writing to TA I have successfully switched baseband configuration from W1358 (WCDMA band 1 2 5 8) to L1357_20W1358 (LTE band 1 3 5 7 20 and WCDMA 1 3 5 8)
but still have a lot of data from TA partition 1 difference, such as rfnv files, so I need more TA S1 Dump to determine which data affect the baseband configuration

here is a modified version flashtool based on flashtool 0.9.18.5 version, which can fast dump all TA data include TA partition 1 and 2

dump step:
click File -> Switch pro to enable Advanced menu
click Advanced -> Trim Area -> S1 Dump to dump ta, them reboot phone to flashmode

if you do not want to send me imei, cert , wlan mac and deviceid info to me, can remove 000007D3,000007E6,000007E7, 00000A00,00000A01,00000A02,00000A03,00001324 lines in 2.ta
000007D3 a SIN file contains imei
000007E6 MARLIN data
000007E7 a cert file contains imei
00000A00,00000A01,00000A02,00000A03 WLAN MAC address
00001324 device Id

please send dump to my gmail “squallatf at gmail.com”

"x10flasher.zip" is the modified version
"x10flasher org.zip" is the original version

Hexchain · Apr 1, 2015

Hi,

I saw your work at http://xdaforums.com/showpost.php?p=59778029&postcount=104. It was impressive. Thank you!

I have an L36h (running CyanogenMod since bought, so no original TA backup) and I saw the same values (W12458 and yuga_rowwtr_W12458) in my TA dump (but different addresses from yours).

Have you successfully enabled 4G LTE for your device? Maybe you can get free upgrade to 4G at China Unicom.

SquallATF · Apr 1, 2015

Hexchain said:
Hi,

I saw your work at http://xdaforums.com/showpost.php?p=59778029&postcount=104. It was impressive. Thank you!

I have an L36h (running CyanogenMod since bought, so no original TA backup) and I saw the same values (W12458 and yuga_rowwtr_W12458) in my TA dump (but different addresses from yours).

Have you successfully enabled 4G LTE for your device? Maybe you can get free upgrade to 4G at China Unicom.

Address is not important, token will same,there is a service hinder me to upgrade to 4g on my card, this month is no hope, I will try in May, can you send me a S1 dump? I will do some compare.

Hexchain · Apr 2, 2015

SquallATF said:
Address is not important, token will same,there is a service hinder me to upgrade to 4g on my card, this month is no hope, I will try in May, can you send me a S1 dump? I will do some compare.

Well that's too bad, it's just the beginning of April!

I was unable to use your x10flasher.jar with FlashTool 0.9.18.5 for Linux. Error:

Code:

$ ./FlashTool
Not running as root but Sony/SonyEriccson Vendor ID found on your udev rules
if Flashing didn't work well, run flashtool as root
JAVA_HOME not set. Using default value : ./x10flasher_lib/linjre64
ldd: warning: you do not have execution permission for `x10flasher_lib/linux/lib64/udev/libusbx-1.0.so.0.1.0'
Exception in thread "main" java.lang.NoClassDefFoundError: joptsimple/OptionSet
	at java.lang.Class.getDeclaredMethods0(Native Method)
	at java.lang.Class.privateGetDeclaredMethods(Class.java:2693)
	at java.lang.Class.privateGetMethodRecursive(Class.java:3040)
	at java.lang.Class.getMethod0(Class.java:3010)
	at java.lang.Class.getMethod(Class.java:1776)
	at sun.launcher.LauncherHelper.validateMainClass(LauncherHelper.java:544)
	at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:526)
Caused by: java.lang.ClassNotFoundException: joptsimple.OptionSet
	at java.net.URLClassLoader$1.run(URLClassLoader.java:372)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:361)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:360)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
	... 7 more

Plus, it would be better if you provide a way for people to strip IMEI and other sensitive information from their dump

SquallATF · Apr 2, 2015

Hexchain said:

Well that's too bad, it's just the beginning of April!

I was unable to use your x10flasher.jar with FlashTool 0.9.18.5 for Linux. Error:

Code:

$ ./FlashTool
Not running as root but Sony/SonyEriccson Vendor ID found on your udev rules
if Flashing didn't work well, run flashtool as root
JAVA_HOME not set. Using default value : ./x10flasher_lib/linjre64
ldd: warning: you do not have execution permission for `x10flasher_lib/linux/lib64/udev/libusbx-1.0.so.0.1.0'
Exception in thread "main" java.lang.NoClassDefFoundError: joptsimple/OptionSet
	at java.lang.Class.getDeclaredMethods0(Native Method)
	at java.lang.Class.privateGetDeclaredMethods(Class.java:2693)
	at java.lang.Class.privateGetMethodRecursive(Class.java:3040)
	at java.lang.Class.getMethod0(Class.java:3010)
	at java.lang.Class.getMethod(Class.java:1776)
	at sun.launcher.LauncherHelper.validateMainClass(LauncherHelper.java:544)
	at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:526)
Caused by: java.lang.ClassNotFoundException: joptsimple.OptionSet
	at java.net.URLClassLoader$1.run(URLClassLoader.java:372)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:361)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:360)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
	... 7 more

Plus, it would be better if you provide a way for people to strip IMEI and other sensitive information from their dump

run as root, you can remove 000007D3,000007E6,000007E7, 00000A00,00000A01,00000A02,00000A03,00001324 lines in 2.ta
000007D3 a SIN file contains imei
000007E6 MARLIN data
000007E7 a cert file contains imei
00000A00,00000A01,00000A02,00000A03 WLAN MAC assress
00001324 device Id

Hexchain · Apr 2, 2015

SquallATF said:
run as root

Same error. Well guess I'll try getting a Windows desktop.

ozaki86 · Apr 2, 2015

IF someone get error at the x10flasher modified ver. step
Just rename any name for firmwares folder will be ok.

SquallATF · Apr 2, 2015

Hexchain said:
Same error. Well guess I'll try getting a Windows desktop.

you need add udev rules http://xdaforums.com/showthread.php?t=1612273

sipe1 · Apr 3, 2015

Hi SquallATF, I sent you my dump to e-mail, hope will help! C6602 TA dump.

daniLaLaLaLaLa · Apr 5, 2015

did this work for ZL? anyone has tested this?

Sent from C6502

sipe1 · Apr 6, 2015

@SquallATF

I sent you C6603 TA Dump on e-mail.

yuht10veyu · Apr 9, 2015

send L36h S1 dump Without persional data to your email.

goodnightPal · Apr 9, 2015

Dear God, called SquallATF,
Could you unlock branded phones bootloader via similar way?? It would be awesome

yuht10veyu · Apr 10, 2015

Already flash my L36H(c6602) with your attachments "TA+v3 baseband".

The China Unicom 4G FDD-LTE is perfect with DATA and CALL.:victory:
See the ScreenShots.:fingers-crossed:

william9524 · Apr 10, 2015

The telecom I'm using only have band 28 and band 3 (LTE)
But I just got the signal this morning. Even through the signal is weak.
Maybe C6602 is till possible to use band 3

RyomaEchizen · Apr 10, 2015

Any chance to use band 4 AWS?

Enviado desde mi Sony Xperia ZL (C6502) mediante Tapatalk 4

Gstream · Jun 1, 2015

yuht10veyu said:
Already flash my L36H(c6602) with your attachments "TA+v3 baseband".
The China Unicom 4G FDD-LTE is perfect with DATA and CALL.:victory:
See the ScreenShots.:fingers-crossed:

View attachment 3254404

View attachment 3254405

what android version you use ?
i tried unlock on 4.4.4 but cannot connecting lte.
in my country works onli LTE bands 9 and 20 (800MHz).

---------- Post added at 02:14 PM ---------- Previous post was at 02:02 PM ----------

its works on 4.4.4, maybe needs another android version ? I unlock successfully on 4.4.4 but not see LTE signal. In my country works 800/1800 lte frequency.

ozaki86 · Jun 2, 2015

Gstream said:
what android version you use ?
i tried unlock on 4.4.4 but cannot connecting lte.
in my country works onli LTE bands 9 and 20 (800MHz).

---------- Post added at 02:14 PM ---------- Previous post was at 02:02 PM ----------

its works on 4.4.4, maybe needs another android version ? I unlock successfully on 4.4.4 but not see LTE signal. In my country works 800/1800 lte frequency.

Because C6602 seems support band 1,5,8 only.
So your phone doesn't find LTE signal

Alphology · Jun 2, 2015

pls for lollipop :victory:

Gstream · Jun 2, 2015

ozaki86 said:
Because C6602 seems support band 1,5,8 only.
So your phone doesn't find LTE signal

so if i flash 4.4.2 and try again it's not give resultat ?

C6602 LTE unlock test

Member

Attachments

Senior Member

Member

Senior Member

Member

Senior Member

Member

Member

Senior Member

Senior Member

Senior Member

New member

Senior Member

New member

New member

Attachments

Senior Member

New member

Member

Member

New member

Similar threads

Top Liked Posts