Remove All Ads from XDA

BenQ E72: collection of findings

1,443 posts
Thanks Meter: 251
By tobbbie, Senior Member on 24th December 2008, 11:23 AM
Thread Deleted Email Thread
Hi all, recently bought BenQ E72 (candidate to replace my Tornado) has kept me busy and below is my findings-log (which most of them I could not find elsewhere, so they may be useful for you as well).
My device is intended for BT Fusion Service (which is no more offered) and this may explain the cheap price at Expansys.UK (I have not bought it from them, but from a different source in the UK offering refurbished ones).

Unfortunately my device was sent without a wired headset (which I am still struggeling to get). My investigations on the dual-use of the mini-USB are so far failing to decode the use of the wires. I suspect that (just like for the Motorola Razor V3) some active electronic parts are required in the headset to communicate with the mobile.

Cleanup \Windows folder:
- Remove locales not needed for MunduIM (fr, it, br, ...directories)
- \Data folder is for beetzRSS -> move to SD card in options menu
- \Java folder for JBED -> move to SD card, change keys in registry at (HKEY_CURRENT_USER\Software\JBlend)
- \Profiles folder for PIE -> move to SD card by changing paths at: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Shell Folders (may not be persistent if card is not ready at boot time or is removed)
- \Rings folder for ringtones -> also in \windows but are not referenced from there, so they stay here
- \skins folder is for HipCam (HKEY_LOCAL_MACHINE\Software\Emuzed Inc\HipCam)
- \sounds folder is for Camera sounds (HKEY_LOCAL_MACHINE\System\Pictures\Camera\OEM)
- \themes folder is for HipCam (HKEY_LOCAL_MACHINE\Software\Emuzed Inc\HipCam)
- \traveller folder for FIZZ Traveler
(move to SDCard, change items in HKEY_CURRENT_USER\Software\FizzSoftware\MicroClien t\TRS)

Ring tones selected from:
\windows\ring*.* (no midi)

Install more than one T9 language:
- get packages from
- download also the package that you already have + the ones you want (so all have the same version)
- install them all, ignore device reboot requests in the meantime
- edit HKEY_LOCAL_MACHINE\T9 Input Method\MUI\Languages string "Available" to contain concatenated (separated by comma) all language numbers
- reboot device

Retrieve hidden settings/options in the setup menus by removing the commenting in the relevant XML files:
- callforwarding.cpl.xml get CFU settings for Data and Fax (Phone->Call Forwarding)
- clckalrm.cpl.xml get Automatic Timezone setting from Network (Clock&Alarm->TimeZone->AutoTimeZone)
- telephonygsm.cpl.xml get Frequencyband selection (Phone->Band Selection = usually "automatic")
- connectgsm.cpl.xml get SMS delivery options (Connections->SMS Service = usually "circuit only")

This device obviously is configured differently for several operators (see \windows\initflashfiles.dat).
Mentioned interesting strings are Orange, movistar, Flashlite, etc..
Intersting that the BT Fusion does not have an entry here.

Power Drain:
- batteryfunctions do not deliver drain and temperature, but the backup battery voltage is reported
Drain is (rough values):
- 60 mA Display visible
- 90 mA Lowest Light
- 110 mA more
- 120 mA normal
- 130 mA high
- 150 mA highest
BT creates peaks ~ 10 mA on top roughly once per second
WiFi creates peaks ~60 mA similar rate as above
- power off still drains the battery to charge the backup battery but only a few µA (micro Ampere)

Interesting Programs (not linked via .lnk files) in \windows:
- DevHealth.exe will also be called by LogMaster and creates a very elaborate memory and process report. It is named "mem_1.txt" and is either located in the Storage Card root or the main memory root, sized ~ 292kB. Subsequent calls will generate files named mem_<n>.txt where <n> relates to the called number. This file includes the DLL relationship of all active loaded modules, so it is easy for ROM cleaners to sort out the debug ROM remains.
-> This is the key application to investigate further any modifications of Startup options or ROM modifications.
- LogMaster.exe sets various trace and log points, can call netlogctl.exe, swmodemtrace.exe, celogflush.exe, DevHealth.exe, WinsockLogApp.exe, links to LogUtil.dll which relates to logfiles: OSImageVersion.txt, sqpco.log, sqmodem.log, sqdriver.log, sqatcmd.log)
- QDW.exe (internall referenced: "QDW.exe is launched by AppExceptionMonitor.exe", but this .exe is missing, only a dll is remaining) This would read (or write) to files in \Windows\System\ExceptionExtraLogs\. It calls copylog.exe to do the job.
If directly called it asks for a memory card and generates a directory \yyyymmdd_hhmmss\ExceptionExtraLogs\ generating (copying) files ELog.txt KITL.txt qatcmd.log qdriver.log qmodem.log qpco.log verinfo.txt call is hinished with "copy failed".
- PreForWSA.exe is called via HLKM\init\Launch.. and may prepare WinSockLogging (may call \Windows\WinsockLogApp.exe)
- prtscrn.exe generates a screendump of the current state, it is also called via long press of the Vol-Up key and generates a file called scncap<n>.jpg in the "\My Documents" folder (<n> is a sequence number starting at 1).

- remove UMAClient.exe from \HKLM\init\Launch.. but still keep WiFi switched off after reboot. UMAClient cares for the settings in Settings->Connections->WiFi transmission. If not loaded also the WiFi mode to disable WiFi if not connected after <time> does not work.

Candidates for ROM Cleanup:
- CeRegExport.exe (not a valid Windows CE application), executes on PC and links to rapi.dll to communicate with the device.
- D3DMDemo.exe (just displays a boiuncing ball and a rotating colored cube)
- D3DMPerf.exe (displays a colored cylinder, then quits)
- related dlls: D3DM_TI3D.dll, d3dm.dll (not referenced in mem_1.txt)
- AppExceptionMonitor.dll
...more to add here once ROM cooking will be possible

What do these programs do?
- ERS.exe (stays resident, links to coredll.dll only)

enjoy + enhance,

24th December 2008, 01:02 PM |#2  
znial's Avatar
Senior Member
Flag Bologna
Thanks Meter: 33
thanks for your effort.
i'll study this report and compare with my e72 (by expansys, sim free and app locked, unlocked by utility found on the net)
5th June 2009, 07:02 AM |#3  
Junior Member
Thanks Meter: 0
can't edit the windows files
Thanks for the information. I have been trying to get access to the 'band' setting for some time. However I have been unable to edit the actual xml files. I have tried using SDA unlocker and RAPI and keep getting 'phone is unlockable'. How are you editing these files?
5th June 2009, 08:57 AM |#4  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 251
You cannot edit them onboard as they are in ROM. Copy them to your PC, remove the Read-Only attribute, edit and copy it back to the device. It will put in device memory and virtually overwrite the ROM copy. If you delete it on the device the old ROM copy will be used again.
5th June 2009, 01:53 PM |#5  
Junior Member
Thanks Meter: 0
Thanks. That is what I have been trying to do, but every time I get '...could not be placed on device. You do not have permission to create item'. It is like the file system is locked, but I cannot find a way to get past it. Any ideas?
5th June 2009, 02:50 PM |#6  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 251
Oh, yes you need to unlock it first. No clue how I did it, it is also not directly mentioned in my old blog. But from there are some links to other sites - you need to look it up there. It is basically the same thing that needs to be done on any WinMo device. Have you tried to search here already (use "E72 Unlock" as a start)?
6th June 2009, 02:45 AM |#7  
Junior Member
Thanks Meter: 0
Thanks. I was able to unlock the phone, copy the xml files off make the changes (removed the commenting), and copy them back to the device. However when I try to use a control panel function that relies on one of these xml files I get 'the control panel document telphonygsm.cpl.xml cannot be loaded. Verify the XML and try loading the control panel again.'

The XML is well formed (as best as I can tell), yet I get this every time I swap in the modified file I get this. If I put the original back in place everything is fine. It looks like the XML is bad, but I can't find anything wrong with it.
Attached Files
File Type: zip - [Click for QR Code] (988 Bytes, 27 views)
6th June 2009, 05:29 AM |#8  
Junior Member
Thanks Meter: 0
Ok, I think I figured it out. In the section that was commented out there were languages that were not relevant to what I had setup on the phone. Once I removed those it accepted the XML files and I was able to view the control panel. Thanks for your help.
14th June 2009, 09:50 PM |#9  
Senior Member
Thanks Meter: 0
Good stuff here. Bump up.
12th July 2009, 08:43 AM |#10  
Senior Member
Thanks Meter: 33
Has anyone found a way to change default hardkey mappings ?
1st October 2009, 03:27 PM |#11  
Junior Member
Flag Buenos Aires
Thanks Meter: 0
Impressive! Thank you for your hard work. I have the same phone and I am glad we can all share our findings here.
I believe a good source of information will be in the engineering menu which I can't access (yet).
I don't plan on hitting random codes but I can tell you how to enter a code if you want to:

Be warned, there are codes that will trash your ROM, so be careful!

Also, I am planning on running this on my phone when I have some free time:

I will log my findings asap

Cheers from Argentina!
Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes