FreeCalypso > hg > freecalypso-tools
annotate doc/Compal-unlock @ 995:74024eb17e04
fc-loadtool help: improve language regarding 16 MiB flash chips
In FC project history, 16 MiB flash originally meant Pirelli DP-L10.
Then we got FCDEV3B with the same flash (our own design), but now we are
discovering more Calypso devices that used such large flash, both late
Calypso era (Sony Ericsson K2x0) as well as much earlier ones (FIC FLUID
devices.txt file with 2004 dates, Leonardo+ rev 5). Hence we need to
migrate to more generic or neutral language in associated documentation,
without giving elevated status to specific examples that drove our
early project history.
author | Mychaela Falconia <falcon@freecalypso.org> |
---|---|
date | Sun, 03 Dec 2023 21:11:12 +0000 |
parents | 21eec7569eb8 |
children |
rev | line source |
---|---|
0
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
1 Using FreeCalypso tools to unlock Motorola C1xx phones |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
2 ====================================================== |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
3 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
4 The ultimate goal of the FreeCalypso project is to produce our own complete GSM |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
5 dumbphone firmware which We the People fully own, control and compile from |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
6 source ourselves, running at first on some selected pre-existing hardware |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
7 targets, and then ultimately on our own Free Dumb Phone hardware. While that |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
8 goal is still far past the visible horizon, what can we do in the meantime to |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
9 make our current forced use of existing proprietary dumbphone firmwares a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
10 little more tolerable? This article presents one such hack: using FreeCalypso |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
11 loadtools to dump the flash content of Compal phones for analysis, including |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
12 TIFFS, and to replace one existing proprietary fw version with another, e.g., |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
13 to remove carrier branding and the associated SIM restriction. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
14 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
15 Serial access |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
16 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
17 Mot C1xx (Compal) phones have a 2.5 mm headset jack that dual-functions as a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
18 debug/programming serial port. In hardware terms, there is an electrically |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
19 controlled switch (MUX) inside that switches the external jack between the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
20 analog headset signals and the digital serial ones; this switch is controlled |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
21 by a GPIO signal from the Calypso. The hardware power-up state of this switch |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
22 is serial; Mot/Compal's standard fw switches it to headset upon boot, but the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
23 serial setting persists long enough to use it to break into the bootloader. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
24 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
25 Bootloader |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
26 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
27 The Calypso DBB (digital baseband) chip used in these phones has an on-chip |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
28 boot ROM, but it also has a hardware pin that enables or disables this boot |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
29 ROM, and unfortunately these phones have it disabled. If the boot ROM were |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
30 enabled in hardware, it would provide an unstoppable and unbrickable way to |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
31 take control of the device through the externally-accessible serial port like |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
32 we have on Openmoko and Pirelli phones, but unfortunately the hardware we have |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
33 available is not wired that way. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
34 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
35 However, Mot/Compal's standard firmware on these phones includes a bootloader, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
36 a part that executes before any of the rest of the fw image is allowed to |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
37 execute or is made use of in any way, and this Compal-specific bootloader has a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
38 provision for interrupting the boot process and diverting it to an externally- |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
39 supplied piece of code loaded over the serial line. Older fw versions have |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
40 this feature enabled unconditionally, but some of the newer versions have a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
41 malfeature whereby the serial boot interrupt and code download possibility may |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
42 be disabled. Some C1xx phones out in the wild, particularly all North American |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
43 C139s with TracFone branding and some of the Cingular-branded ones as well, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
44 have such maliciously-locked firmware in them. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
45 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
46 Fortunately though, these maliciously-locked firmwares (or at least all versions |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
47 we've encountered so far) have been found to have another hole through which we |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
48 can break in, as described in the TFC139-breakin article. We can exploit this |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
49 hole in the firmware to gain code execution access to the Calypso, and then use |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
50 the latter to reprogram the flash, replacing the ultra-malicious firmware with |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
51 some other version that, although still proprietary, is a little less evil. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
52 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
53 Making first contact |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
54 ==================== |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
55 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
56 If you have a C1xx phone which you are seeking to free, your first step should |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
57 be to try breaking in with fc-loadtool, using the Compal bootloader method. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
58 With the phone powered off, but containing a charged battery (SIM present or |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
59 absent, doesn't matter), proceed as follows: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
60 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
61 1. Connect the serial or USB-serial cable between your PC or other host and the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
62 target phone's headset jack. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
63 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
64 2. On the host end, run fc-loadtool like this: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
65 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
66 C11x/123: fc-loadtool -h compal /dev/ttyXXX |
11
21eec7569eb8
loadtools support for C139/140 target: -c 1004 compalstage variant
Mychaela Falconia <falcon@freecalypso.org>
parents:
0
diff
changeset
|
67 C139/140: fc-loadtool -h compal -c 1004 /dev/ttyXXX |
0
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
68 C155/156: fc-loadtool -h c155 /dev/ttyXXX |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
69 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
70 3. Press the power button on the phone. A momentary press is sufficient and |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
71 recommended: the hardware powers up and causes the boot code to run exactly |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
72 the same whether the power button is pressed momentarily or held down. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
73 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
74 Normal phone power-up requires the button to be held down because the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
75 standard firmware does a check fairly late in the boot process to see if the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
76 power button is still held down, and commands the hardware (the ABB) to |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
77 power off if it is not - it is a standard feature to prevent phones from |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
78 turning themselves on inadvertently from accidental momentary presses of |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
79 that button. But if the goal is to cause the boot code to run, but not to |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
80 boot the regular fw all the way, a momentary press is ideal. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
81 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
82 If your phone has a bootloader without the malicious lock in it, the above |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
83 procedure should result in fc-loadtool gaining full access to the target and |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
84 landing you at a loadtool> prompt. You can dump the flash content and analyse |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
85 it, etc. If you would like to change to a different fw version (to remove the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
86 SIM lock / carrier branding or for any other reason), see the corresponding |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
87 later section of this article. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
88 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
89 Alternative method |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
90 ================== |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
91 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
92 If the above procedure fails to gain access to the Calypso because the boot |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
93 code in the phone never offers a serial download opportunity, the alternate |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
94 break-in method should be tried, going through the full running firmware |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
95 instead of just the bootloader part thereof. Proceed as follows: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
96 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
97 1. Remove the SIM (if there was one to begin with) and put the charged battery |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
98 back in. Charge the battery if necessary, using the standard charging |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
99 function of the existing fw. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
100 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
101 2. Power the phone up for normal boot: hold the power button down like a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
102 regular user would, without fc-loadtool or other serial break-in tools. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
103 The fw will boot up, notice the lack of a SIM, and the display will read |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
104 "SIM card absent" or something to that effect, depending on the fw version. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
105 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
106 3. Key in this magic sequence: **16379#. A hidden "Trace Switch" menu should |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
107 appear, with the choices being "Trace On" and "Earphone". Select "Trace On". |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
108 The electrically controlled hardware switch mentioned earlier in this article |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
109 should now be set back to the UART, bringing the latter out to the headset |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
110 jack. Because Mot/Compal's firmware is based on TI's reference architecture, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
111 the interface presented by the running fw on this serial port is TI's RVTMUX, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
112 albeit at 57600 baud instead of TI's default of 115200. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
113 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
114 4. Connect the headset jack serial cable if it wasn't already connected, and |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
115 run this FreeCalypso utility: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
116 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
117 tfc139 /dev/ttyXXX |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
118 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
119 (The name tfc139 is historical; the current version is expected to work with |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
120 all Mot C1xx firmwares.) |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
121 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
122 Compal's TI-based firmware implements some of TI's Test Mode commands, and one |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
123 of these commands is a raw memory write. It also implements some of TI's GPF |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
124 "system primitive" commands, including the MEMCHECK command that causes the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
125 firmware to report some info on all running GPF tasks, including the location |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
126 of each task's stack. Our tfc139 utility will try to break into the phone |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
127 (gain code execution access) by querying the target fw for the location of the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
128 L1A task's stack, and then using Test Mode memory write commands to write a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
129 piece of shellcode into an unused RAM location and to make this code execute by |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
130 overwriting a function return address on the stack of the L1A task that |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
131 processes these Test Mode commands. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
132 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
133 If the stack smashing hack succeeds, the shellcode injected by tfc139 will send |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
134 a message out the serial port indicating this success, and then re-enable the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
135 Calypso boot ROM and jump to it. Once the boot ROM code gains control, it will |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
136 wait forever for a serial code download following its standard protocol. If |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
137 tfc139 gets the success indication from the target, it will announce this |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
138 success and direct you to run: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
139 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
140 fc-loadtool -h compal -c none /dev/ttyXXX |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
141 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
142 Do as it says. The -c none option tells fc-loadtool to skip compalstage and |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
143 proceed directly to feeding loadagent to the Calypso boot ROM. You should now |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
144 be in full control of the phone via fc-loadtool. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
145 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
146 There is one additional quirk worth mentioning. It appears that Mot/Compal's |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
147 main fw keeps resetting the RTC alarm registers in the Calypso DBB as it runs, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
148 always keeping the alarm time in the near future relative to the current time. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
149 When one breaks into this firmware with tfc139 and takes over the control of |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
150 the device with fc-loadtool, this alarm time will almost certainly be reached, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
151 and the RTC alarm will go off. This alarm has no effect on loadtool operation |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
152 (i.e., it cannot reset the CPU or otherwise wrestle control away from loadtool, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
153 so it doesn't add any bricking risk), but it has one quite surprising effect |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
154 upon exit, i.e., when you are done with your loadtool session and give it the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
155 exit command. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
156 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
157 Loadtool's configured default exit action for this target is to send a power-off |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
158 command to the Iota ABB, leaving the device cleanly powered off. However, if |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
159 the RTC alarm has gone off previously during the session, the ABB will instantly |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
160 power the phone back on, and put it through a new boot cycle. The firmware |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
161 handles this special form of boot rather oddly: it proceeds to the same end |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
162 state it would have reached via a normal power button hold-down boot (powered |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
163 on with the "Insert SIM" message on the LCD), but it reaches this state almost |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
164 instantly, without going through the power-on LCD logo and buzz phase. Odd, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
165 but harmless. This explanation has been included to save other hackers the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
166 hours of bewildered head-scratching I spent chasing this quirk down. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
167 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
168 Dumping and reloading flash |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
169 =========================== |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
170 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
171 Once you break in with fc-loadtool (either through the bootloader or through |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
172 tfc139), the first step you should do is make a dump (backup) of the flash: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
173 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
174 loadtool> flash dump2bin flashdump.bin |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
175 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
176 Before you do any flash write (erase or program) operations, please realise |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
177 that these phones are brickable. Because the Calypso boot ROM is disabled at |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
178 the board level (Calypso DBB's nIBOOT configuration input is tied high directly |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
179 underneath the BGA package!), when the phone powers up, the ARM7 core starts |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
180 executing instructions directly out of the flash, from address 0. Therefore, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
181 flash sector 0 must contain good working boot code (one that allows serial code |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
182 download access for recovery) at all times. If you erase this sector or fill |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
183 it with some garbage (anything other than good working boot code) and then power |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
184 the phone off or otherwise lose control of it, the phone will be unrecoverably |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
185 bricked! |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
186 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
187 On most C1xx models there seems to be no way to access the Calypso's JTAG |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
188 signals, hence no possibility of using JTAG to unbrick a bricked phone. And |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
189 because the flash chip is a micro-BGA, it is quite unlikely that one could |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
190 successfully desolder it, program it in a standalone flash chip programmer, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
191 and then put it back on the board. Thus if you brick your C1xx phone, then |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
192 most likely it is truly toast. You've been warned! |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
193 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
194 That being said, if your phone came with a maliciously locked bootloader, such |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
195 that you had to use tfc139 to break in, then replacing that bootloader with a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
196 non-malware version is pretty much a necessity, and taking the chance of |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
197 bricking the phone becomes a necessary risk. Even if the bootloader version in |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
198 your C1xx is free of the locking malfeature, if you need to reflash the main fw |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
199 to a different version, one still needs to erase and reprogram the dangerous |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
200 sector: on C11x/123 and C139/140 the main fw image starts at 0x2000, but the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
201 erase block boundary doesn't come until 0x10000. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
202 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
203 The good news, however, is that fc-loadtool has special support for rewriting |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
204 the boot sector on Compal phones with minimal risk of bricking. The command is: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
205 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
206 flash erase-program-boot binfile [length] |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
207 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
208 The first argument is the name of the file (in straight binary format) |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
209 containing the new boot code; the second argument (always interpreted as hex) |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
210 is the number of bytes to program, always starting at 0. If only one argument |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
211 is given, the length of the file is used instead, which must not exceed the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
212 length of flash sector 0: 64 KiB on C11x/123 and C139/140, or 8 KiB on C155/156. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
213 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
214 This special command minimizes the bricking vulnerability window by loading the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
215 entirety of the new boot code to be programmed into a scratchpad RAM buffer on |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
216 the target first (no problem because it's 64 KiB max), then commanding loadagent |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
217 (the code that actually runs on the Calypso when you use fc-loadtool) to perform |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
218 the "atomic" operation of erasing flash sector 0, then immediately reprogramming |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
219 it with the bits that are already in scratchpad RAM on the phone. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
220 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
221 With this approach the phone will only be bricked if the battery dies or is |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
222 physically yanked out of the phone in the time window between the beginning of |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
223 the erase operation and the last critical bit of the new boot code being |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
224 programmed - on the order of a second or two, or if the flash operations fail |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
225 for some reason. However, the phone will *not* be bricked with this approach |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
226 if the serial connection between fc-loadtool or the target gets broken during |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
227 the window in question, or if the host machine running fc-loadtool crashes: no |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
228 flash operations start until loadtool gives the go-ahead command to loadagent, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
229 and once loadagent receives the latter command, it will proceed till completion |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
230 without caring if loadtool is still there or not. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
231 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
232 Of course the conventional flash erase and flash program-bin commands will be |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
233 happy to operate on flash sector 0 just like any other sector, but doing so is |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
234 NOT recommended, as the window of vulnerability for bricking would then be |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
235 considerably greater. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
236 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
237 Unlocked firmware for C139 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
238 ========================== |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
239 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
240 If your phone is a North American (1900+850 MHz) C139, and you are reading this |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
241 article because it came with Cingular or TracFone branding, whereas you would |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
242 like to use it with SIMs and networks of your own choosing instead, you've come |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
243 to the right place. We have an unlocked and non-carrier-branded (Mot branding |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
244 only) version of the fw that runs on these phones, and you can use FreeCalypso |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
245 loadtools to flash this version into your C139 whether it came with Cingular or |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
246 TF branding originally. Download this file: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
247 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
248 ftp.freecalypso.org:/pub/GSM/Compal/c139-unlocked-fw.zip |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
249 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
250 Unzip it, and you'll get c139-unlocked-fw.bin - that is the image you'll need |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
251 to flash into your phone. Get in with fc-loadtool (using tfc139 if necessary |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
252 for bootloader-locked phones) and make a backup of the original flash content. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
253 Then reflash the firmware as follows: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
254 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
255 flash erase-program-boot c139-unlocked-fw.bin 2000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
256 flash erase 10000 360000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
257 flash program-bin 2000 c139-unlocked-fw.bin 2000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
258 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
259 The 3 commands given above will reflash the phone as follows: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
260 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
261 * The first 0x2000 bytes of the firmware image in c139-unlocked-fw.bin comprise |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
262 the boot code. This fw version features the "good" boot code *without* the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
263 access locking malfeature. The erase-program-boot command will erase flash |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
264 sector 0 (the entire 64 KiB sector, as the physics of the flash chip dictates) |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
265 and then immediately reprogram its first 8 KiB with the "good" boot code from |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
266 the unlocked fw image file. The remaining 56 KiB of this sector will be blank |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
267 after this step. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
268 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
269 * The following "regular" flash erase command is to erase the following 54 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
270 sectors (also of 64 KiB each) in preparation for programming the main fw |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
271 image in there. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
272 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
273 * The last command programs the bulk of the fw image into blank flash that has |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
274 been erased by the first two commands. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
275 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
276 I also recommend erasing the old FFS that was maintained by the old fw version, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
277 so that the new fw will automatically format a "virgin" FFS the first time it |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
278 boots: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
279 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
280 flash erase 370000 50000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
281 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
282 After this procedure the phone should retain its original IMEI and factory RF |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
283 calibration values, as these are stored in the 8 KiB sector at 0x3FC000 which |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
284 is not touched per the above procedure - not in the FFS. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
285 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
286 The same procedure should be followed for flashing all firmwares for C11x/123 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
287 and C139/140 phones. In the case of C11x/123, adjust the length for the "main" |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
288 erase and program operations appropriately for the flash configuration in your |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
289 phone. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
290 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
291 Flashing newer firmware versions |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
292 ================================ |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
293 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
294 The flashing procedure given above, where the first 0x2000 bytes of the new fw |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
295 image (the bootloader part) are written with the flash erase-program-boot |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
296 command and the regular flash program-bin command writes everything from 0x2000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
297 onward, is only correct for older firmware versions whose bootloader portion is |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
298 completely free from the access locking malfeature: not only unlocked, but with |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
299 no provision for locking at all. In these older fw versions the boot code is |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
300 fully contained in the first 0x2000 bytes and nothing from 0x2000 onward affects |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
301 the ability to perform a new serial boot, hence the bricking vulnerability |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
302 window ends at 0x2000. However, this flashing procedure should NOT be used for |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
303 newer fw versions that have the provision for locking the bootloader - it's the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
304 provision that matters in this case, even if the lock hasn't been activated - |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
305 if you flash one of these newer fw versions as above, you will risk bricking |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
306 your phone! |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
307 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
308 If you need to flash one of the newer fw versions that includes the bootloader |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
309 lock provision, you need to take some additional precautionary steps: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
310 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
311 1. Examine the fw image you wish to flash with a hex dump viewer. Look starting |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
312 at offset 0x2000. You should see 3 identifying ASCII strings: one right at |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
313 0x2000, another at 0x2020 and one more at 0x2040. Then look at 4 bytes at |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
314 offset 0x2060. If they contain 0xFFFFFFFF (blank flash) like the surrounding |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
315 unused bytes, then you have an older fw version without the bootloader lock |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
316 provision - you can safely flash it as in the previous section. If it's a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
317 newer fw version with the bootloader lock provision, the word at 0x2060 will |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
318 contain either 0x00000000 or 0xDDDDDDDD, corresponding to the activated |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
319 (access disabled) and non-activated (access enabled) states of the lock, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
320 respectively. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
321 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
322 2. If the fw image you wish to flash has 0x00000000 at 0x2060, you must patch |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
323 it to 0xDDDDDDDD with a hex editor before flashing. Just because our tfc139 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
324 utility can recover phones with maliciously locked bootloaders does NOT mean |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
325 that you should *ever* deliberately flash such a bootloader-locked fw image |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
326 into your phone! Recovery of locked phones via tfc139 depends on the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
327 complete fw image being present and working, not just the bootloader part, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
328 hence if you were to flash an image that has a lockable bootloader with the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
329 lock activated, the bricking vulnerability window will extend until the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
330 *entire* fw image has been programmed - far too dangerous. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
331 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
332 3. When flashing the image with fc-loadtool, use a slightly different command |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
333 sequence compared to the previous section: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
334 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
335 flash erase-program-boot new-fw-image.bin 10000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
336 flash erase 10000 360000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
337 flash program-bin 10000 new-fw-image.bin 10000 360000 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
338 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
339 The difference is that the boundary between the part handled with flash |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
340 erase-program-boot and the part handled with flash program-bin has been moved |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
341 from 0x2000 to 0x10000. Because the word at 0x2060 is part of the bricking |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
342 vulnerability window with these newer fw versions, one should rewrite the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
343 entire boot sector of the flash (including the beginning of the main fw image) |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
344 with flash erase-program-boot for safety. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
345 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
346 Unlocking while keeping the same fw version |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
347 =========================================== |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
348 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
349 Suppose you have a phone with a locked bootloader such that you had to break in |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
350 with tfc139, you would like to unlock it so you can use RAM-based (non-flash) |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
351 tools such as c139explore or OsmocomBB with it, but you have no particular need |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
352 to change the main fw from the original version to a different one. If you |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
353 need to perform such a cisversion unlock, you can do it as follows: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
354 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
355 1. Break in with tfc139; |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
356 2. Use fc-loadtool's flash dump2bin command to save the first 64 KiB sector |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
357 of the flash to a file; |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
358 3. Using a hex editor, patch the word at 0x2060 from 0x00000000 to 0xDDDDDDDD; |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
359 4. Use fc-loadtool's flash erase-program-boot command to flash the patched |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
360 (unlocked) boot sector back into the phone. |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
361 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
362 C155/156 differences |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
363 ==================== |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
364 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
365 C155/156 phones are nicer than the others in that they use a flash chip with a |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
366 "bottom boot" configuration. C11x/123 and C139/140 use "top boot" flash chips, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
367 which is why the boot code and the first 56 KiB of the main fw image live in |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
368 the same erase block on those phones. The boot code and the control hand-off |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
369 interface between it and the main fw have also been revamped in C155/156 fw, |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
370 and the new structure is: |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
371 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
372 8 KiB sector at 0: contains the boot code |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
373 7 more 8 KiB sectors starting at 0x2000: blank and unused |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
374 64 KiB sector at 0x10000: also blank and unused |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
375 64 KiB sector at 0x20000: beginning of main fw image |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
376 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
377 With this new flash layout, it is now possible to erase and program the main fw |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
378 region starting at 0x20000 without ever erasing the boot code sector or doing |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
379 any writes to it, so there is no bricking vulnerability window at all. (The |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
380 phone can still be bricked though if one types the wrong command and erases the |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
381 boot sector inadvertently, so be careful.) |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
382 |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
383 So far the only phones in this family that I laid my hacking hands on have been |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
384 North American C156 units, all from the same seller and batch (hence identical), |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
385 so I don't know if there exist any maliciously-locked boot code versions in |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
386 this family - the boot code in my C156 is free of any malfeatures. But if "bad" |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
387 versions of C155/156 boot code do exist, and if you can break into the phone |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
388 somehow, you can use the flash erase-program-boot command to rewrite the boot |
e7502631a0f9
initial import from freecalypso-sw rev 1033:5ab737ac3ad7
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
389 code with minimal risk of bricking just like on the other Compal families. |