DEV ONLY - NAND access + Full Unlock for Lumia 710 & 800

xsacha · Apr 15, 2012

ceesheim said:
also changed filesize to the coresponding ?

Hm? Filesize didn't change.

lilstevie · Apr 15, 2012

xsacha said:
By the way the device-dependent stuff is repeated again just before the certificate (thanks chessdragon136):

---------- Post added at 03:09 PM ---------- Previous post was at 02:40 PM ----------

Sweet! I got the .esco repack working now.

And I changed both device-dependant areas. Still rejected the bootloader though

Flash File: RM801_12w07_prod_generic_nokia_osbl.esco
Sending certificate...Done.
Sending file...Failed.

try with changing just the first

if we are lucky nokia may have failed hard and use one for the sigcheck and one that actually does the work.

I expect only a portion of the data is signed

xsacha · Apr 15, 2012

Here is an upload zip containing three .esco's:
* Original Lumia 710 Qualcomm Bootloader (+cert)
* As above with top half of cert modified (device dependant area 1)
* As above with entire cert modified (device dependant area 1 + 2)

All of them fail on Lumia 800.

http://www.mediafire.com/?7q44c0231uaa9cp

ombadboy · Apr 15, 2012

xsacha said:
Here is an upload zip containing three .esco's:
* Original Lumia 710 Qualcomm Bootloader (+cert)
* As above with top half of cert modified (device dependant area 1)
* As above with entire cert modified (device dependant area 1 + 2)

All of them fail on Lumia 800.

http://www.mediafire.com/?7q44c0231uaa9cp

Can you also upload just a repacked unchanged version of the .esco, so someone with a 710 can check if that works. Then we can exclude whether the packing (also) causes a problem or not..

tjramage · Apr 15, 2012

xsacha said:
Here is an upload zip containing three .esco's:
* Original Lumia 710 Qualcomm Bootloader (+cert)
* As above with top half of cert modified (device dependant area 1)
* As above with entire cert modified (device dependant area 1 + 2)

All of them fail on Lumia 800.

http://www.mediafire.com/?7q44c0231uaa9cp

It's a long shot, but I'm guessing you tried flashing them with the Nokia Support Tool as well as NSSPro??

Also, on a separate note - has anyone tried flashing to a firmware (11414) with an older version of the Diagnostics app which allows you to change the USB mode from "Zune" to "Serial"?? Perhaps then you could get it recognised by the QPST tool (linked earlier) and possibly flash and/or extract files that way?

Really exciting reading this thread

suzughia · Apr 15, 2012

My diagnostic app can change from Zune to serial but for using QPST you should have Qualcomm baseband - I've already tried it.

Sent from my Lumia 800 using XDA Windows Phone 7 App

tjramage · Apr 15, 2012

Hmmm, ok. That was next on my list of things to try, but I guess I'll leave it then...

xorizont · Apr 15, 2012

So, as we see, my files can really unlock Nokia dload and make it Qualcomm. I'm really glad with it. Now it's important to find the way to unlock Lumia 800s.
Good luck, guys. Thank you for interup-unlock)

biktor_gj · Apr 15, 2012

The question really is... Can QPST put the phone in Download Mode? From within QPST you can jump from one mode to another, maybe even execute something directly on the RAM (and if you can do that, forget about certificates and stuff since you only inject our unlocked bootloader to ram and execute it from there, then reflash the 2nd partition and reboot, then, unlocked bootloader on flash).

Qualcomm's Diagnostics interfaces ARE available on EVERY phone, locked and unlocked. The only thing that's preventing me from tampering around is I can't seem to find any suitable drivers for the MSM7630 surf based board.

As soon as you put the phone USB mode in Serial (Diagnostics App), four devices appear, and all of them are Qualcomm's serial ports, and the four of them can link to QPST, but need drivers!

If you force usbserial in linux you can talk with AT commands to the AMSS on the phone. I think you can even tether your internet connection with it. But can't find drivers to link it to QPST in Windows...

eMMC download mode works for unlocked bootloaders, btw...

rescbr · Apr 15, 2012

For the ones looking on .esco: Nokia.Wezen.Programming.dll.
It seems that it is NCS who is checking certificates etc, not the bootloader.

ceesheim · Apr 15, 2012

rescbr said:
For the ones looking on .esco: Nokia.Wezen.Programming.dll.
It seems that it is NCS who is checking certificates etc, not the bootloader.

lol that is also the same for samsung ( the flashing app is looking for serts )
they hacked the flash tool and then we could load engineering roms

it is good possible by just hacking the flashtool will make it able to flash wrong signed files ( wrong because phone normally always look for a cert but in this case just a normal one from or nokia or Qcom)

ombadboy · Apr 15, 2012

@xsacha, how exactly can you check if a firmware has the Qualcomm or NOKIA DLOAD bootloader? I've got a hunch and trying some stuff out, but without flashing the firmware how is it possible? I saw somewhere your using a hex editor but on what file exactly in the RM-803 posted in the other thread (in particular)? Cheers!

tjramage · Apr 15, 2012

ombadboy said:
@xsacha, how exactly can you check if a firmware has the Qualcomm or NOKIA DLOAD bootloader? I've got a hunch and trying some stuff out, but without flashing the firmware how is it possible? I saw somewhere your using a hex editor but on what file exactly in the RM-803 posted in the other thread (in particular)? Cheers!

I'm pretty sure you can find out by looking at the size of the osbl file. I may be wrong, but I think the Nokia DLOAD osbl file is approximately ~932KB...

rescbr · Apr 15, 2012

ombadboy said:
@xsacha, how exactly can you check if a firmware has the Qualcomm or NOKIA DLOAD bootloader? I've got a hunch and trying some stuff out, but without flashing the firmware how is it possible? I saw somewhere your using a hex editor but on what file exactly in the RM-803 posted in the other thread (in particular)? Cheers!

Open the .esco file on a Hex editor and look for "Nokia DLOAD" (or "Qualcomm CDMA Technologies MSM")

ombadboy · Apr 15, 2012

Yup got it.. You firstly need to unpack the .esco and look at the .mbn file inside.. we're looking at the NOKIA DLOAD .esco file to be 932kb and 933 kb, whereas the Qualcomm one is 835kb.. I went through each and every firmware available on NaviFirm for the Lumia 710 and 800 and I can confirm NONE have the qualcomm bootloader (anymore) (maybe Nokia addressed the issue).

Even the one posted by xorizont has the NOKIA DLOAD bootloader on Navifirm.. If you guys have any OLD firmware files you downloaded.. could you please host them somewhere so I can take a look?

Maybe downgrading to one of those (if they have the Qualcomm bootloader) might do the trick!

tjramage · Apr 15, 2012

ombadboy said:
Yup got it.. You firstly need to unpack the .esco and look at the .mbn file inside.. we're looking at the NOKIA DLOAD .esco file to be 932kb and 933 kb, whereas the Qualcomm one is 835kb.. I went through each and every firmware available on NaviFirm for the Lumia 710 and 800 and I can confirm NONE have the qualcomm bootloader (anymore) (maybe Nokia addressed the issue).

Even the one posted by xorizont has the NOKIA DLOAD bootloader on Navifirm.. If you guys have any OLD firmware files you downloaded.. could you please host them somewhere so I can take a look?

Maybe downgrading to one of those (if they have the Qualcomm bootloader) might do the trick!

I have a ton of old firmwares from months ago back when I was testing them for battery performance issues... All of them have the 932KB osbl esco file

EmaTheLegend · Apr 15, 2012

I tried to open with HEX Editor 2 esco files extracted from 2 updates downloaded with navifirm...
First image is relative to release 11465 : first occurrence of DLOAD is at address 590D0.
Second image is relative to latest release (12070) : first occurrence of DLOAD is at address 5DF0 ("Secure DLOAD started")

_Madmatt · Apr 15, 2012

I'm a noob in all this, but is there no way to port the 710 bootloader to the 800? We know what parts are different. Wouldn't it work to sort-of copy paste the unknown parts in the 710 bootloader? I really don't know, the idea sounds too simple to be true, but maybe you can try it out?

ombadboy · Apr 15, 2012

tjramage said:
I have a ton of old firmwares from months ago back when I was testing them for battery performance issues... All of them have the 932KB osbl esco file

Could you please list which ones you have checked? So we can tick them off the list.. There must be one that they forgot the Qualcomm bootloader in, as with the Lumia 710!

Cheers!

---------- Post added at 08:09 PM ---------- Previous post was at 08:06 PM ----------

ombadboy said:
Could you please list which ones you have checked? So we can tick them off the list.. There must be one that they forgot the Qualcomm bootloader in, as with the Lumia 710!

Cheers!

xscacha has been trying to do that, he posted a few firmwares in previous post but to no success.. Feel free to grab the .esco file from: http://narod.ru/disk/45935058001.2aaca38c9acf622332f4a81b5bf0e331/RM-803.rar.html

credit xorizont

---------- Post added at 08:11 PM ---------- Previous post was at 08:09 PM ----------

I can confirm Nokia is onto this, and fixed any firmware on NaviFirm with the Qualcomm bootloader! So any stored versions you have on your PCs could prove useful!

biktor_gj · Apr 15, 2012

NaviFirm doesn't get every file from Nokia Care Suite. I've been also digging into this. Put NCS in online mode, you'll find 11414 firmwares in there. Still haven't found anything witch qcsbl yet, but still looking. The more people we look into it, the more probable we'll find something!

Regards,

DEV ONLY - NAND access + Full Unlock for Lumia 710 & 800

Senior Member

Senior Recognized Developer

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Retired Forum Moderator

Senior Member

Senior Member

Member

Senior Member

Senior Member

Member

Attachments

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts