Related
Official ROMs:
Qtek 8500 Rus v3.6.261.0 - WM5 AKU v2.3
http://www.myqtek.com/media/817887-ruu_sta...tekrus_ship.exe
mirror: http://rapidshare.com/files/53991872/ruu_s...tekrus_ship.rar
i-mate Smartflip v1.2.301.2 - WM5 AKU v2.3
ftp://ftp.clubimate.com/i-mate_Smartflip_....301.2_ship.zip
Cingular 3100/3125 v4.1.502.5 - WM5 AKU v3.4.2
http://rapidshare.com/files/53993022/ruu_star100_4.1.502.5_02.79.30_cws_ship.rar LINK UPDATED in 2023
Qtek 8500 Europe v3.6.251.0 - WM5 AKU v2.3
http://rapidshare.com/files/56652190/RUU_S...tekEUR_Ship.exe
mirror: http://rapidshare.com/files/53991558/ruu_s...tekeur_ship.rar
mirror: http://www.myqtek.com/media/914075-ruu_sta...tekeur_ship.exe
Qtek 8500 Europe v3.6.251.1 - WM5 AKU v2.3
http://rapidshare.com/files/239051225/RUU_STAR100_3.6.251.1_02.97.90_QtekEUR_Ship.exe (thanks sash99)
Qtek 8500 Scandinavia v3.6.252.0 - WM5 AKU v2.3
http://www.myqtek.com/media/758929-8500_upgrade.zip
Dopod 710(+)/S300 v1.32.707.0 WM5 AKU v2.3
http://rapidshare.com/files/53995708/ruu_s...podwwe_ship.rar
Dopod 710(+)/S300 v1.2.709.1 WM5 AKU v2.3
http://www.fs2you.com/en/files/762f56b8-e2...b-0014221b798a/ - Dead link, mirror needed
HTC S411 v3.5.511.2 WM5 AKU v3.0.0
http://rapidshare.com/files/212279006/RUU_STAR100_S411_SHIP.exe
that is a custom made official ship s411 rom, made on the base of rom dump by r0ny_k3t
tested and worked
There are some more StarTrek's official ROMs:
http://rapidshare.com/users/1NBLVZ
Searching for more HTC S411 roms. If you have a HTC S411, dump a rom using this manual and upload it anywhere please!
radios
What are the different radios?
These are the ones I know of:
02.79.30
02.79.47
02.79.97
i'm using 02.79.30
i need a german rom wos wirdn do ned kappiert
Update for Cingular 3100/3125 official rom
Erofich said:
Official ROMs:
Cingular 3100/3125 v4.1.502.5 - WM5 AKU v3.4.2
http://www.america.htc.com/support/docs/RU...30_CWS_SHIP.exe
Click to expand...
Click to collapse
Up link is wrong, below is the latest available URL:
Cingular 3100/3125[/B] v4.1.502.5 - WM5 AKU v3.4.2
http://member.america.htc.com/download/Software/RUU_STAR100_4.1.502.5_02.79.30_CWS_SHIP.exe
uniface said:
Up link is wrong, below is the latest available URL:
Cingular 3100/3125[/B] v4.1.502.5 - WM5 AKU v3.4.2
http://member.america.htc.com/download/Software/RUU_STAR100_4.1.502.5_02.79.30_CWS_SHIP.exe
Click to expand...
Click to collapse
Wrong again.
You need the cookies from the HTC site. Without them you can't download anything.
Btw, if you haven't this link already, here are some more official ROMs.
But what are the radio versions?
I saw someone else asked the question, but I was not clear on the answer. What is a radio version? What does it do? What does it mean? And does the radio version need to be updated separately, or does that get updated with a flashed ROM?
uniface said:
Up link is wrong, below is the latest available URL:
Cingular 3100/3125[/B] v4.1.502.5 - WM5 AKU v3.4.2
http://member.america.htc.com/download/Software/RUU_STAR100_4.1.502.5_02.79.30_CWS_SHIP.exe
Click to expand...
Click to collapse
Thanks.
jbogstartrek said:
I saw someone else asked the question, but I was not clear on the answer. What is a radio version? What does it do? What does it mean? And does the radio version need to be updated separately, or does that get updated with a flashed ROM?
Click to expand...
Click to collapse
Just use your default radio.
Looking for Dopod S300 v1.2.709.1 WM5 AKU v2.3 ROM
I'm looking for this ROM as I need to restore my S300 back to working order, which was this specific version (v1.2.709.1). The link that is posted (http://www.fs2you.com/en/files/762f56b8-e2...b-0014221b798a/) doesn't work, so does anyone have an alternate download location so I can reflash my phone? Thanks for your help in advance.
Dead Qtek 8500...how connect to USB
Dead Qtek 8500...how connect to USB?
please help.
br
Dejan
Swedish ROM
Hi, does anyone have a Swedish ROM update?
I've got my S411 from repair today...
I already application unlocked it, and dumping the ROM...
EDIT: ROM DUMPED & UPLOADED...
There's the log from pdocread:
C:\itsutils>pdocread -l
41.96M TrueFFS
| 2.06M Part00
| 2.44M Part01
| 37.46M Part02
69.19M TrueFFS
| 2.06M Part00
| 2.44M Part01
| 37.46M Part02
1.88G DSK1:
| 1.87G NO_NAME
STRG handles: 0fb7ff2e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.87G) cfad339e
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 68.93M) 0fb5e38a
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
( 37.46M) 0fb5e18e
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
( 2.44M) afb5e16a
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
( 2.06M)
C:\itsutils>pdocread -w -d TrueFFS -p Part00 -t
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
real nr of sectors: 4222 - 2.06Mbyte (0x20fc00)
C:\itsutils>pdocread -w -d TrueFFS -p Part01 -t
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
real nr of sectors: 4992 - 2.44Mbyte (0x270000)
C:\itsutils>pdocread -w -d TrueFFS -p Part02 -t
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
real nr of sectors: 76716 - 37.46Mbyte (0x2575800)
C:\itsutils>pdocread -w -d TrueFFS -p Part00 0 0x20fc00 Part00.raw
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
CopyTFFSToFile(0x0, 0x20fc00, Part00.raw)
C:\itsutils>pdocread -w -d TrueFFS -p Part01 0 0x270000 Part01.raw
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
CopyTFFSToFile(0x0, 0x270000, Part01.raw)
C:\itsutils>pdocread -w -d TrueFFS -p Part02 0 0x2575800 Part02_0.raw
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 c1 29 02 03 19 2e 12 da 1b 07 06 ff
CopyTFFSToFile(0x0, 0x2575800, Part02_0.raw)
Zipped all three (Part0*.raw) and uploaded on Rapidshare, there's the download link:
http://rapidshare.com/files/208572128/S411_Dump_itsutils.rar.html
MD5: ED922EAFDF12E7823ED3CD05E9208420
Hope i've made everything all right ;-)
I managed to use "viewimgfs.exe" on "Part02.raw", got the dump folder w/ the system files onto it, also used another tool, and got it organized to a SYS and OEM folder...
Is it possible to make a .nbh file with those three raws, so i could recover my S411 using the MicroSD flashing method without SuperCID it?
ok, thanks, downloading it now
hi there
http://rapidshare.com/files/212279006/RUU_STAR100_S411_SHIP.exe
HTC S411 rom, made on the base of above mentioned dump, not tested.
Please feedback after flashing.
Erofich said:
hi there
http://rapidshare.com/files/212279006/RUU_STAR100_S411_SHIP.exe
HTC S411 rom, made on the base of above mentioned dump, not tested.
Please feedback after flashing.
Click to expand...
Click to collapse
Thanks! Now I can flash back to my stock rom when needed
Is it possible to recover my S411 by microSD flashing?
is an official rom? i mean i could recover my bricked HTC S411?
aldo0203 said:
is an official rom? i mean i could recover my bricked HTC S411?
Click to expand...
Click to collapse
no you can't flash it without entering WM OS, because rom is not signed by official htc certificate
just flashed htc s411 rom mentioned in the 1st post, works fine
OS version is 5.1.342 Build 15096.3.0.0
ROM version is 3.5.511.2
Last ROM for Cingular 3125
Hi
Which is last rom for cingular 3125 ? i'm using WM6.1 Build 5.2.19593 AKU 1.1.7 by Erofich of erofich... is posible put a new rom or i'm wrong ? thanks
the newest Cingular rom is 4.1.502.5
Dear all [especially the developers],
Is there a practical way of changing the above mentioned ROM's page pool?
Is there a tool?
I tried Latest Page Pool Changer release [V.2.21] but it doesn't behave as it should.
With JCEspi2005's help I realized it doesn't report or write the right or, at least, the reported and visible values...
How can we sort this out?
Can someone point me in the right direction?
Hang Tua, given the fact I am solely using your ROMs would you be so kind you would help me?
Click to expand...
Click to collapse
Dear all,
INTRODUCTION
With JCEspi2005 precious help and guidance and Swiftblade precious information, we both came to the conclusion that Raphael page pool change method can now be unveiled.
CONSIDERATIONS
JCEspi2005 changed a ROM's page pool to 24 and I tested it.
Result: Ok.
I changed 2 ROM's page pool and tested it.
Result: Ok.
TOOLS
A Hex editor like:
XVI32 V.2.31 ¤ Link
HexEdit V.1.03 ¤ Link
PROCEDURE [Information source: Link]
Address: 70F0
Values:
[00MB Pagepool] |00 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[12MB Pagepool] |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[16MB Pagepool] |10 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[18MB Pagepool] |12 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[24MB Pagepool] |18 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
1. Open the OS.nb or the .NBH file with a Hex Editor
2. Search the for hex string pattern |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| [Two addresses should be found]
3. At the first address found, change the first two bytes "03 15" to "12 16" for 18MB pagepool
4. Repeat Step Nº 3 at the 2nd address found
5. Save & Exit the Hex Editor
6. If you are using the OS.nb, start cooking your new ROM with it
7. Flash the new .NBH file to your Raphael and enjoy the 18MB True Pagepool
For other pagepool sizes, change the first byte "03" to "XX" hex value corresponding to your desired pagepool in Step Nº 3 and 4. [Remember that this is hex value, i.e. "10" = 16MB, "12" = 18MB, "18" = 24MB, etc.]
Happy Page Pool changing, happy flashing and cheers!
P.S. There were some doubts about dynamic page pool [Page Pool 0] usage but after a day of testing 0 page pooled ROMs I can almost assure the there are not stability issues.
Although several more days of testing [at least 2] are needed to ensure it doesn't affect stability, by now, I can infer that it is quite stable as well as reliable.
MEMORY
Do note that your available memory will differ according to the page pool you use.
If you feel like knowing how much memory you will have available after page pool change, maybe it's time for some linear and simple arithmetics
This post will be updated as we find out about new information or outcoming issues.
Special thanks to JCEspi2005. I hope out «partnership» goes on and on
Cheers and good luck to all.
Hi there,
I've tried pagepool changer and it appears to work just as it says on the tin!
If you look on the right hand side of the windows there is a box where you can change the pagepool size. Hit the button and you'll notice that the ROM file has been changed (Check the date stamp if you don't believe me) I've checked the ROm image with a hex editor and it has change the corrct values.
Hope this helps.
WizP said:
Hi there,
I've tried pagepool changer and it appears to work just as it says on the tin!
If you look on the right hand side of the windows there is a box where you can change the pagepool size. Hit the button and you'll notice that the ROM file has been changed (Check the date stamp if you don't believe me) I've checked the ROm image with a hex editor and it has change the corrct values.
Hope this helps.
Click to expand...
Click to collapse
Attached is a little application to run in your PDA. DevHealth.exe generates a mem_X.txt file on your SD card root (let some time to do it). Inside this file you can view the real PagePool.
Can you test your changed ROM to see what changes do?
Cheers
WizP said:
Hi there,
I've tried pagepool changer and it appears to work just as it says on the tin!
If you look on the right hand side of the windows there is a box where you can change the pagepool size. Hit the button and you'll notice that the ROM file has been changed (Check the date stamp if you don't believe me) I've checked the ROm image with a hex editor and it has change the corrct values.
Hope this helps.
Click to expand...
Click to collapse
That's not the question...
The question is: Does it read and change the right addresses?
No it doesn't. JCEspi2005 created a ROM with PP12 and the referred tool reads 6.
I'll try to find a tool that correctly addresses Raphael ROMs.
Cheers.
mrvanx asked me about this thread.... yes I can confirm the pagepool changer will not work, as nk.exe dynamically sets pagepool, depending on (probably) ram size. htc niki and elf/elfin are the same deal.
this is easy to fix of course with a small assembly patch
cmonex said:
this is easy to fix of course with a small assembly patch
Click to expand...
Click to collapse
Pls guide us to the true path
cmonex said:
mrvanx asked me about this thread.... yes I can confirm the pagepool changer will not work, as nk.exe dynamically sets pagepool, depending on (probably) ram size. htc niki and elf/elfin are the same deal.
this is easy to fix of course with a small assembly patch
Click to expand...
Click to collapse
Thanks, this is just i was beleaving...
Are you planing yo make the "small" patch for us?
Following this post http://forum.xda-developers.com/showpost.php?p=2274534&postcount=1 i managed to create a modified NBH of WWE shipped ROM wirh 24Mb PagePool for someone to test it (i can't do it for now...)
The link
http://rapidshare.com/files/1488550...el_CRC_52.33.25.17_1.02.25.19_Ship_PP24Mb.rar
Report back, please...
Thanks.
cmonex said:
mrvanx asked me about this thread.... yes I can confirm the pagepool changer will not work, as nk.exe dynamically sets pagepool, depending on (probably) ram size. htc niki and elf/elfin are the same deal.
this is easy to fix of course with a small assembly patch
Click to expand...
Click to collapse
Would you be so kind you would inform us (if you can) of the addresses and values for Raphael ROM's pagepool?
Even if there is no tool yet, we can HEX edit the NBH and change it.
I am personally interested in pagepool 0 [dynamic].
Thank you in advance.
Cheers.
well, here is an example:
.text:80058220 B0 28 9F E5 LDR R2, =dword_803F6350
.text:80058224 A8 78 9F E5 LDR R7, =0xA8081064
.text:80058228 00 30 95 E5 LDR R3, [R5]
.text:8005822C 9C 88 9F E5 LDR R8, =0x52444C55
.text:80058230 94 08 9F E5 LDR R0, =aKPagePoolSize0
.text:80058234 01 0C 53 E3 CMP R3, #0x100
.text:80058238 03 15 A0 03 MOVEQ R1, #0xC00000
.text:8005823C 02 15 A0 13 MOVNE R1, #0x800000
.text:80058240 00 10 82 E5 STR R1, [R2]
.text:80058244 00 30 97 E5 LDR R3, [R7]
.text:80058248 08 00 53 E1 CMP R3, R8
.text:8005824C 01 15 A0 03 MOVEQ R1, #0x400000
.text:80058250 00 10 82 05 STREQ R1, [R2]
0x803F6350 is what the pagepool changer usually patches, this is set to 6MB by default in the nk.exe. the problem is the real pagepool will never be 6MB, this code above dynamically decides if 4, 8, or 12MB it should be. (on my raphael it went for 12MB)
the elf patch is ok, as long as the STREQ on the last line doesn't execute, if it does, then copying the elf patch is not enough. so I suggest this patch:
STR R1, [R2] -> NOP (00 00 A0 E1)
and STREQ R1, [R2] -> another NOP (00 00 A0 E1)
after this pagepool changer should work nicely, and this is easier than that patching for Elf. once you patch the nk.exe like this, it will be fine.
on top of that, an entirely cosmetic patch: you can change the R1 contents too (similar to Elf patch) so KITL log will show the right value.
P.S: my guess is it only sets it to 4MB if ULDR is loaded. so usually not of importance.
Raphael ROMs Page Pool Changing
First post updated. Do read it
Cheers.
cmonex said:
well, here is an example:
.text:80058220 B0 28 9F E5 LDR R2, =dword_803F6350
.text:80058224 A8 78 9F E5 LDR R7, =0xA8081064
.text:80058228 00 30 95 E5 LDR R3, [R5]
.text:8005822C 9C 88 9F E5 LDR R8, =0x52444C55
.text:80058230 94 08 9F E5 LDR R0, =aKPagePoolSize0
.text:80058234 01 0C 53 E3 CMP R3, #0x100
.text:80058238 03 15 A0 03 MOVEQ R1, #0xC00000
.text:8005823C 02 15 A0 13 MOVNE R1, #0x800000
.text:80058240 00 10 82 E5 STR R1, [R2]
.text:80058244 00 30 97 E5 LDR R3, [R7]
.text:80058248 08 00 53 E1 CMP R3, R8
.text:8005824C 01 15 A0 03 MOVEQ R1, #0x400000
.text:80058250 00 10 82 05 STREQ R1, [R2]
0x803F6350 is what the pagepool changer usually patches, this is set to 6MB by default in the nk.exe. the problem is the real pagepool will never be 6MB, this code above dynamically decides if 4, 8, or 12MB it should be. (on my raphael it went for 12MB)
the elf patch is ok, as long as the STREQ on the last line doesn't execute, if it does, then copying the elf patch is not enough. so I suggest this patch:
STR R1, [R2] -> NOP (00 00 A0 E1)
and STREQ R1, [R2] -> another NOP (00 00 A0 E1)
after this pagepool changer should work nicely, and this is easier than that patching for Elf. once you patch the nk.exe like this, it will be fine.
on top of that, an entirely cosmetic patch: you can change the R1 contents too (similar to Elf patch) so KITL log will show the right value.
P.S: my guess is it only sets it to 4MB if ULDR is loaded. so usually not of importance.
Click to expand...
Click to collapse
Thanks for so deep info
The procedure is like the Elfin one...
Cheers
jcespi2005 said:
Thanks for so deep info
The procedure is like the Elfin one...
Cheers
Click to expand...
Click to collapse
yeah, and who pointed that out originally?
I've tried the posted procedure for finding, and changing the Pagepool - but everytime i search for the hex string, i get no returned results. Am i doing something wrong?
Anyone able to return to s-on once they got s-off?
Sent from my Liberty using XDA App
andrew.cambridge said:
Anyone able to return to s-on once they got s-off?
Sent from my Liberty using XDA App
Click to expand...
Click to collapse
why would you?
brswattt said:
why would you?
Click to expand...
Click to collapse
HERE Usually you put it back on when repairs are needed.
---------- Post added at 03:43 PM ---------- Previous post was at 03:42 PM ----------
brswattt said:
why would you?
Click to expand...
Click to collapse
warranty, and free repairs.
---------- Post added at 03:44 PM ---------- Previous post was at 03:43 PM ----------
andrew.cambridge said:
Anyone able to return to s-on once they got s-off?
Sent from my Liberty using XDA App
Click to expand...
Click to collapse
Find Unroot methods on this Page.
gotcha. ;p
Alpharev site states that loading a stock RUU will revert HBOOT and hence s-on.
I haven't tried it.
For repair work. I can send in for repair, then sell it for a small profit.
artiemon said:
Alpharev site states that loading a stock RUU will revert HBOOT and hence s-on.
I haven't tried it.
Click to expand...
Click to collapse
This doesn't work.
http://forum.xda-developers.com/showthread.php?t=1160251
Start here.you'll have to pull the hboot img from the 2.2.2 ruu.I'd also recommend contacting attn1 on irc chat node.If you brick your phone don't cry to me.
Sent from my HTC Aria using XDA App
andrew.cambridge said:
For repair work. I can send in for repair, then sell it for a small profit.
Click to expand...
Click to collapse
what's wrong with it? How much you are asking for? How much is it right now without repairs? I need a Evo testing phone, is there a XDA community discount? do you have insurance?
Tekn010933 said:
what's wrong with it? How much you are asking for? How much is it right now without repairs? I need a Evo testing phone, is there a XDA community discount? do you have insurance?
Click to expand...
Click to collapse
PM me
Sent from my MB860 using XDA App
Getting back to hboot that came on phone
I have read through the post http://forum.xda-developers.com/showthread.php?t=1160251 and it make sense if you have a wildfire phone.
The instructions show how to update the memory location to fool the flash into thinking it is getting an upgrade rather than a downgrade(which it will refuse).
For the wildfire, this is done with the command "fastboot oem mb 9C068490 1 30".
Does anyone know how to figure out what memory location needs to get updated with what value for the Aria? The exact fastboot command would be great.
Here is a dump from my Aria using the command "fastboot oem mb ?"
C:\fastboot>fastboot oem mb ?
... INFOmemory dump
INFO00000000: 2E 31 30 30 32 00 00 00 | 1002...
INFO00000010: 37 32 32 37 20 53 50 4C | 7227 SPL
INFO00000018: 00 00 00 00 00 00 A0 E1 | ........
INFO00000020: 53 48 49 50 00 00 00 00 | SHIP....
INFO00000028: 00 00 A0 E1 00 00 A0 E1 | ........
INFO00000030: 48 42 4F 4F 54 2D 37 32 | HBOOT-72
INFO00000038: 32 37 00 00 00 00 A0 E1 | 27......
INFO00000040: 64 69 72 74 79 2D 34 35 | dirty-45
INFO00000048: 62 66 39 38 37 31 00 00 | bf9871..
INFO00000050: 00 00 0F E1 80 10 80 E3 | ........
INFO00000058: 01 F0 29 E1 30 0F 11 EE | ..).0...
INFO00000060: 02 01 80 E3 30 0F 01 EE | ....0...
INFO00000068: 00 00 A0 E3 9A 0F 07 EE | ........
INFO00000070: 10 0F 11 EE 02 06 80 E3 | ........
INFO00000078: 10 0F 01 EE 00 00 A0 E3 | ........
INFO00000080: 9A 0F 07 EE 02 01 A0 E3 | ........
INFO00000088: 16 00 80 E3 92 0F 0F EE | ........
INFO00000090: 00 00 8F E2 DD 00 00 EB | ........
INFO00000098: 00 00 00 40 00 00 C0 12 | [email protected]
INFO000000A0: D4 00 00 00 00 00 40 4D | [email protected]
INFO000000A0: D4 00 00 00 00 00 40 4D | [email protected]
INFO |
OKAY
I would prefer to flash the hboot from original AT&T RUU which I have extracted. It is named "hboot_liberty_7227_0.57.0000_100507_.nb0".
Any help would be appreciated.
I picked up an Samsung Gio but did not like it. feels to cheap for an 200.00 CDN Phone also sound on the device is to low cant hear the sound when outside so I'm thinking about picking up the LG Eclypse so my Question is: Is there an LG Eclypse | LG-C800G Unlock Tool? or a way for me to grab the unlock key from within the device like I did with the Samsung Gio?
can I use this method ?
http://forum.xda-developers.com/showpost.php?p=17148825&postcount=334 : - adb shell
- su
- cat /dev/bml5>/sdcard/bml5.img (BE-EM-EL-FIVE is about 25 Mb)
- exit (2x)
- adb pull /sdcard/bml5.img
- now open in hex editor on PC (like xvi32)
- find the proper block with hex search:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 FF FF FF FF FF FF FF FF FF FF FF FF FF FF (2 times)
Scroll a few pages of FF's down until you see the first number (unlock code)
- my unlock code is at #1282C0A
- put locked sim in phone, boot and enter code from above
Click to expand...
Click to collapse
Thanks in advance,
clml
Anyone?
Sorry if I seem inpatient but I dont want to take back the Gio and pick up the LG if I cant unlock it without charge as money is really tight as wife is pregnant and on bed rest so want to have a phone that I could actually hear when outside as that's where I spend most of my days is outside due to work.
hello all, is there a cyanogenmod rom for Acer Liquid Z3 (Z130)
Thanks
bryan-k said:
hello all, is there a cyanogenmod rom for Acer Liquid Z3 (Z130)
Thanks
Click to expand...
Click to collapse
here stock rom for z130 bro : http://www.acer.com.sg/ac/en/SG/content/drivers/4889;-;Z130
:victory:
is there any custom rom that would work on the z3 ?
((
micdarau85 said:
is there any custom rom that would work on the z3 ?
((
Click to expand...
Click to collapse
Mhh, just found this post, was never a ROM for this phone developed?
I just would like to skin down the stock rom and make it lighter...
g
Rom developing
It is possible to root the acer liquid Z3 (Z130) as well as installing TWRP. I'm about to develop Cyanogenmod for it. I hope that admins will give me a thread to start posting instructions:
Howto root it: root it using the app framaroot: http://forum.xda-developers.com/apps/framaroot/root-framaroot-one-click-apk-to-root-t2130276
Howto flash it with TWRP: Install and execute rashr and flash recovery with TWRP:
https://docs.google.com/file/d/0B0XQigIT17uEcDQtaDJ3U0UtOWc/edit?pli=1
The kernel source is availible at http://us.acer.com/ac/en/US/content/drivers
The supposed procedure in getting the z130 specific image is (excerpt of kernel source readme):
Build steps:
1. Download Android 4.2.2 source code from google
2. Modify buildGPL.sh, replace the Your_Toolchain_PATH with your tool path in android code.
for example: android/prebuilts/gcc/linux-x86/arm/arm-linux-androidYour_Toolchain_PATHeabi-4.6/bin
3. Run the script under your shell
./buildGPL.sh
Thanks!
Click to expand...
Click to collapse
I'm happy if I get a companion while developing. If you're new to cyanogenmod you can start with:
http://wiki.cyanogenmod.org/w/Build_for_a700#Build_CyanogenMod_and_ClockworkMod_Recovery
Give me a thread and device section !
Greets,
wendenerp
going on
My main motivation in getting cyanogenmod running is to get a german android system language. Since I bought the Z130 in the Phlippines
it only came with English and a couple of Asian languages. None of the language programs (morelocale2, locale, Sprache) could change the system language to german even while rooted. Today I tried to flash a system partition of the Acer homepages' Update images, namely the OS_Acer_AV052.Z130.1.007.00.LA.GEN1s_A42J_A
TWRP worked fine, but it didn't boot. I could rescue to the old system.ext4.win after the Acers' image failed.
I already contacted Acer. Maybe they will at least tell me which image has the german system language and works with the dual sim kernel... I'm still considering cyanogenmod's images though.
I added some detailed german instructions on rooting the liquid z3 and installing TWRP: http://www.wendenerp.de/Sonstiges.html
So far,
wendenerp said:
My main motivation in getting cyanogenmod running is to get a german android system language. Since I bought the Z130 in the Phlippines
it only came with English and a couple of Asian languages.
Click to expand...
Click to collapse
i have the single sim version with european languages. i wish i could get some asian languages on this phone X)
I started a cyanogenmod project on github for the Acer liquid Z3: https://github.com/wendenerp/android_device_acer_zx. I had some trouble with the local manifest file, but I think this should be alright:
<?xml version="1.0" encoding="UTF-8"?>
<manifest>
<project name="wendenerp/android_device_acer_zx" path="device/acer/zx" remote="github" revision="cm-11.0" />
</manifest>
Click to expand...
Click to collapse
Next thing is to get the vendor specific programs and drivers out of the original firmware...
I'm having some problems with getting the ramdisk image out of boot.img.
The boot.img is 6 mb in size. I tried unpackbootimg, unmkbootimg and split_bootimg. All of these tools split the same way:
The kernel gets 4mb and the ramdisk 600k, which adds up to 4.6mb. Additionally the ramdisk is of file type data:
Code:
file boot_img.lzma
boot_img.lzma: data
so neither gunzip nor lzma -dc works to extract the initramfs. I assume there is a bug in all of these split tools or acer made up some strange boot.img format...
boot.img split error
Unfortunately the split utilities don't split the boot image correctly.
The image should contain the size and location of the kernel and ramdisk inn the first bytes of the boot.img, but this is how it looks like:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ hd boot.emmc.win |grep 'ANDROID' -n4
1:00000000 41 4e 44 52 4f 49 44 21 58 36 3d 00 00 80 00 10 |ANDROID!X6=.....|
2-00000010 34 bc 09 00 00 00 00 11 00 00 00 00 00 00 f0 10 |4...............|
3-00000020 00 01 00 10 00 08 00 00 00 00 00 00 00 00 00 00 |................|
4-00000030 31 33 37 37 37 30 33 33 30 39 00 00 00 00 00 00 |1377703309......|
5-00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
The split_bootimg.scrip takes the values out of the first too rows in little endian to determine the sizes and locations:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ ./split_bootimg.pl boot.emmc.win
Page size: 2048 (0x00000800)
Kernel size: 4011608 (0x003d3658)
Kernel location: 268468224 (0x10008000)
Ramdisk size: 638004 (0x0009bc34)
Ramdisk location: 285212672 (0x11000000)
Second size: 0 (0x00000000)
Board name: 1377703309
Command line:
Writing boot.emmc.win-kernel ... complete.
Writing boot.emmc.win-ramdisk.gz ... complete.
Unfortenutely the location exceeds the size of the boot.img:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ hd boot.emmc.win
...
0046fc30 00 81 11 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0046fc40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00600000
So it looks like the scipt only pulls some random data from the memory for the kernel and for the ramdisk
In fact the ramdisk starts at a different location:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ hd boot.emmc.win |grep '1f 8b 08'
00005220 6e 20 65 72 72 6f 72 00 1f 8b 08 00 00 00 00 00 |n error.........|
003d4200 1f 8b 08 00 00 00 00 00 00 03 ec 7d 0b 7c 54 c5 |...........}.|T.|
All 3 split utilities do the same:
unpackbootimg, unmkbootimg, split_bootimg
---------- Post added at 12:41 PM ---------- Previous post was at 11:42 AM ----------
since the bootloader is u-boot I think the image has a different format:
HTML:
http://www.compulab.co.il/workspace/mediawiki/index.php5/U-Boot:_Images#Image_format
progress
I also was able to extract the ramdisk out of the boot.img and added it together with the mkvendor.sh output at github.
I was also able to compile the kernel from sources provided at acer.com. I requested the sources of the u-boot image too.
You are doing great job dude keep going )))
U-Boot Source Code request
This is my request to Acer for the U-Boot source:
Dear Sir/Madam,
thank you for your reply. Software licensed under the GPL2 can be reused and modified and sold with the restriction of handing out the source and build instructions for the sold product.
In case of the Acer Liquid Z130, Acer has aquired and modified the following Software:
Linux Kernel, the Android OS, the U-boot bootloader, of which the linux kernel and U-boot is licensed under the GPL2, meaning that acer is obliged to hand out the source code of its modified U-boot and the modified kernel plus the build instructions. Since Acer only handed out the instructions and source of the modified linux kernel on its webpage, it hasn't yet met its obligations.
Since Android uses a different licence, you can refuse to hand out part of its code but you can gain popularity in the opensource community by doing so.
Yours sincerely
Denis Wentland
The request dates from 3th of July. How much time to give them and how to proceed in case they don't follow?
U-boot
While investigating usb-traffic, I encountered some CDC-ACM messages on the powered off, battery removed, usb-connected device . For 1 second the device opens its USB serial port and spams some READYREADYREADY messages . Then it closes it for some 8 seconds again.
On factory mode it asks for the input password on the /dev/ttyACM0 port.
I hope I can find out the password and enter U-Boot command prompt.
Since U-boot is under GPL Acer should hand out the source for me to find out the pasword.
hexdumping the boot loader firmware it has some uboot-messages:
000277f0 2d 20 0a 00 5b 25 73 5d 20 55 6e 70 6c 75 67 67 |- ..[%s] Unplugg|
00027800 65 64 20 43 68 61 72 67 65 72 2f 55 73 62 20 62 |ed Charger/Usb b|
00027810 65 74 77 65 65 6e 20 50 72 65 2d 6c 6f 61 64 65 |etween Pre-loade|
00027820 72 20 61 6e 64 20 55 62 6f 6f 74 20 69 6e 20 4b |r and Uboot in K|
00027830 65 72 6e 65 6c 20 43 68 61 72 67 69 6e 67 20 4d |ernel Charging M|
00027840 6f 64 65 2c 20 50 6f 77 65 72 20 4f 66 66 20 0a |ode, Power Off .|
but unfortunetaly not the Serial output messages
I have a french Acer Z3 Single SIM and as many on XDA i am a kind of flasholic.
I found a file .ZIP opened it and found boot.zip, system.img, recovery.zip that I I flashed from ADB\Fastbboot.
Was able to boot the phone but it’s from dual SIM update Thaï operator.
This one : Update_Acer_AV052_Z130_1.005.00_AAP_AISH https://www.dropbox.com/s/5s07i8g1hq3ekga/Z130SingleSIM_Tha%C3%AFSTOCK_ROM.zip
I don’t get any network signal from it. If it can help…maybe?
WARNING: if some of you decide to dowload this, please do not install it on your phone, because you will not be able to install another System.zip. Or unless you want an asian DUO SIM THAÏ Operator ok! :good:
wendenerp said:
While investigating usb-traffic, I encountered some CDC-ACM messages on the powered off, battery removed, usb-connected device . For 1 second the device opens its USB serial port and spams some READYREADYREADY messages . Then it closes it for some 8 seconds again.
On factory mode it asks for the input password on the /dev/ttyACM0 port.
I hope I can find out the password and enter U-Boot command prompt.
Since U-boot is under GPL Acer should hand out the source for me to find out the pasword.
hexdumping the boot loader firmware it has some uboot-messages:
000277f0 2d 20 0a 00 5b 25 73 5d 20 55 6e 70 6c 75 67 67 |- ..[%s] Unplugg|
00027800 65 64 20 43 68 61 72 67 65 72 2f 55 73 62 20 62 |ed Charger/Usb b|
00027810 65 74 77 65 65 6e 20 50 72 65 2d 6c 6f 61 64 65 |etween Pre-loade|
00027820 72 20 61 6e 64 20 55 62 6f 6f 74 20 69 6e 20 4b |r and Uboot in K|
00027830 65 72 6e 65 6c 20 43 68 61 72 67 69 6e 67 20 4d |ernel Charging M|
00027840 6f 64 65 2c 20 50 6f 77 65 72 20 4f 66 66 20 0a |ode, Power Off .|
but unfortunetaly not the Serial output messages
Click to expand...
Click to collapse
sory idk what it means. but does that mean we cant get it on our z3?
---------- Post added at 06:32 AM ---------- Previous post was at 06:30 AM ----------
hello guys. may i know what bloatware that can safely be remove from this phone? its full with useless app. wish i could uninstall all of it to make it more like stock android
Salut,
as-tu trouver une roms stock pour le z3 ?
Merci
Hi,
Anybody have an original stock ROM for z130 EMEA ?
Please help me. I have lost mine...
Thx...
Sent from my Nexus 5 using XDA Free mobile app
hi guys..
is there Polish language for this device..?
http://www.acer.com.sg/ac/en/SG/content/drivers/4889;-;Z130