+ Reply to Thread
Page 1 of 8
1 2 3 4 5 6 7 ... LastLast
Results 1 to 10 of 80

Thread: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

  1. #1
    DotSIS Member
    Reputation Reputation
    megtheabyss's Avatar
    Join Date
    Feb 2009
    Location
    Kolkata
    Age
    20
    Posts
    116
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    3

    Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    This guide will help you to Downgrade the firmware of your phone or Repair a phone that has been accidentally destroyed due to wrong flashing techniques.Also,you can change your product code.

    I searched on DOTSIS but i couldn't find any thread which dealt with this topic.Sorry if any similar thread exists here.This thread,though wont say how to do evrything 1-2-3,but will give you quite of a knowledge of that cluttery interface.Once you go fully through this thread,you can do everything all by yourself(Hoping you have some tidbit knowledge in flashing).Try reading everything here and always be aware of every setting that you make.Avoid anything that you are not aware of.So,here we go:

    The SW used here is 'JAF 1.98.62':

    A peek at the interface:






    Most of you have probably heard and even used this tool,but if you're not quite familiar with it,here's all you would want to know:


    ================================================== ========
    DCT4 tab

    Flash settings tab
    MCU : Micro Control Unit
    PPM : Post Programming Memory, contains language
    CNT : Content Pack, contains tones, games, etc
    ADSP : Advance Digital Signal Processor, flash file for DSP chips
    APE : Application Processor Engine

    Use INI :

    When you tick this, software will detect phone connected type, and “Use INI” files setting when exist in “Product Directory” for choosing flash files.
    INI : (*.ini)
    This file contains flash files setting for each “Product Code”, including MCU, PPM, CNT, PP (Product Profile), etc.
    (Even in 3250, different product code may have different MCU to be flashed).
    These files are extracted from firmware/data package that we have installed.
    Use this option in order to avoid choosing wrong flash files, example :
    - If you don’t know for sure which MCU, PPM, or CNT.
    - Choose right PPM for language that you want
    - How to choose right CNT that suitable with your PPM
    After a Product Code has been chosen automatically, you can change it manually with other Product Code that you want to flash.

    Run INI :

    After flashing completed, software will upload also Product Profile according INI that has been chosen and flashed.
    Product Profile :
    This file contains customization for each Product Code, example : GPRS settings, WAP bookmarks, etc..
    For Communicator Phone, this file also contains keyboard layout.

    Load NFP:

    NFP: Nokia File Protected

    Data package (MCU, PPM, and CNT) for nokia CDMA phone was compressed as a file :
    *.NFP, and it is protected by password.
    Tick this option, choose *.NFP, software will extracted it automatically as MCU, PPM, and CNT.

    Easy Cable :

    It’s a special cable, suitable with pop-up connector for few type phone, ex : 1600, which can be use for flashing. Thick this if you use this kind of cable.
    RPL 208 :
    PM field number 208 was copied from DATA1/ IMEI flash data.
    Software will back up this area as RPL(DATA1 only), that useful for recover flash IMEI if something happen after flash (IMEI ????), or you changed flash IC, you no need to change UEM also if you have back up for this phone. Some type don’t have this field, like 1100, 2300, etc. Make sure your phone can enter Local Mode for this option.
    FTD ON:

    FTD : Field Test Display / Net Monitor : special menu for DCT4 and DCT4 TIKU that can be activated with flashing, it contains many feature for testing phone and network.

    Product Code :

    Every Nokia phone has 7digit number that written in the back sticker.
    This Product Code will differ phone that sold to one country and another, also phone that sold with customization for an operator, will have different Product Code also.
    This number also saved somewhere in PM area.
    Thick “Change Product Code” will change Product Code number in PM area after flashing completed.

    Factory Set :

    Reset all settings to factory default after flash completed.

    Manual Flash:
    this option will disable software detect the phone model and open his folder when you click on “MCU”, “PPM”, etc, or thick on “Use INI”
    Warranty :
    When you press *#warranty# or *#92702689#, phone will display some hidden information like Serial Number, Made, etc, including “Life Timer”.
    This option after flash will reset “Life Timer” back to zero after flashed.

    Unlock:

    Initialize sim lock after flash

    SKIP tab :

    Skip Erase :

    normally, software will erase first some area according Flash Files needed before writing them. If you thick this option, without erase first, software will write the Flash Files that have been chosen. Use this option only if you already have fully erased the phone manually.

    Skip AFP :

    AFP : After Flash Processing

    After flashing completed, software will try to put the phone into Local Mode and read some info about it. This option will disable that process.
    Use this only if you know why this process should be skip, example you flash an Erase File that make the phone dead/ fully erase.
    Not all Erase File erase whole part of flash IC, some Erase File only erase some part of flash IC and phone still alives.

    Skip MCU ID :

    MCU ID is UPP (Universal Phone Processor) recognition, inside flash file, there’s
    recognition for MCU ID that supported (by that flash file).
    Use this option only if you sure that you flash the phone with right flash file, but software give warning that MCU ID is not supported by flash file that have you choose.
    Note : usually warning about MCU ID is not supported but right Flash Files has been chosen is caused by bad cable connection. Try restart software, reconnect F-Bus cable from phone, and try again.
    For dead phone suspected / possibility hardware problem, if MCU flashing has been completed, continue flashing with PPM only usually will solve.

    BT :

    Bluetooth IC have own firmware including in MCU file.
    You may skip this if you flash the phone with same version, this will save flashing time a little.
    But you have to skip this if BT IC is damage, it’s indicated with when you flash a phone and software error in the middle with warning : “Error loading additional loader..”
    Operations Tab :

    INF : INFO

    Make sure your phone can enter Local or Test mode for this operation.
    At the end of this operation, software will detect phone’s Product Code and load Flash Files according it.
    If no suitable product code found, you must thick “Manual Flash” and then “Use INI”,software will ask you to “Select Phone Model”.
    You can sort it by “Type” or by “Name”, or you can type phone code like RH-12, and all “INI” settings for this phone will be loaded, and can be chosen.

    Note : if you don’t find your phone type or name in the list, but you have

    Data Package installed for this phone, open “jaf_nok4models.ini” with Notepad and add it like this
    [RM-307]
    De******ion=Nokia 2505
    and save this file.

    CHK : Check

    Will check phone hardware condition like
    - Relation between UEM (Universal Energy Management - power IC) and UPP (Universal Phone Processor)
    - MCU ID / UPP
    - Flash IC
    - RAM IC
    - First 16 bytes
    - FAID Calculation
    Remember, bad F-Bus cable also make this operation failed !!!
    Service:
    This button related with “Service Operations” tab

    Erase Flash:

    Software will try to back up RPL 208 if your phone can enter Local Mode or IMEI Flash Data not corrupted, or RP 208 exist, and then check phone hardware like MCU ID, etc and display Erase Flash Manager.

    Flash Chip List:

    Below this tab you can choose which IC that you want to erase, and you can modify Erase Address.
    Start Address always 0×000000 and End Address always 0xxFFFFF, depends on Flash IC size.

    FULL Erase :

    Full Erase will erase all Flash IC, including PM (Permanent Memory), & will make SIM Lock Data corrupted.
    Make sure that you have back up PM to be uploaded after flash and unlock after this operation.
    Click Start Erase to execute this operation.

    PM : Permanent Memory, an area in flash IC that wasn’t reached by flash
    files, means normal flashing shouldn’t change it’s value.
    It contains data of RF, EM, Product Code, Security Code, and so many more.
    For some type it also contains backup IMEI Flash Data, even phone book and gallery content.
    PM file can be opened with Notepad or Wordpad.
    PM area indicates with :
    Field Number 0 - xxx (some type has field numbers <200, some has <255, but newer phone type may have 300>).
    Each “Field Number” may has sub “Record Number”
    Field Number indicates with : [x]
    And Record Number indicates with : x=
    If you fully erase a phone, you can upload PM that you have read from another phone which same type, but make sure you have deleted field 5, 120, and 208 from it, ’caused it contains IMEI data.

    Repair Bluetooth :

    Same with erase PM field 4 index 17 (4:17) that contains BT address.
    Some type of Nokia phone save BT address in this field, if this area corrupt or filled with another BT address (maybe caused by upload PM from another phone), & BT can not be switch on, try use this option.
    Read Fls ….

    Prod Dir :

    Change default Flash File detection from C:\Program Files\Nokia\Phoenix to another.

    FLASH : start flashing

    (Un)Lock:
    this button related with “Unlock settings” tab

    Init simlock : Initialize SIM Lock, remove Operator SIM Lock restriction

    Write SIM file : write file *.SIM that contains SIM Lock settings.

    Code Calculator : calculate codes from IMEI number, network code, and ASIC code, for initialize SIM Lock, enter it with type the codes manually with keypad

    Read Codes : read phone for IMEI and calculate code for initialize SIM Lock

    Auto Lock: after this operation, phone will recognize network code from first

    SIM Card that inserted to phone, and lock to this network.

    Autolock IMSI :

    IMSI : International Mobile Subscriber Identity, after this operation, phone will recognize first SIM Card that inserted and lock phone to this SIM.
    Lock to Network: enter the network code manually and phone will be lock to this network

    Load JAVA :

    Upload JAVA application to the phone

    MMC Rst:
    with special cable adapter, this will reset locked Memory Card

    Make INI:
    If you have chosen your flash file manually or USE INI, this operation will create your own “INI file” for that type. After this, software will automatically load that flash files after INF pressed.

    IMEI tool:
    There are 2 IMEI in DCT4 phone:
    First is in UEM, also called DATA2, OTP (one time programmable).
    Second in flash IC, also called DATA1, not OTP.
    If DATA1 get corrupted or not synchronize with DATA2, Watchdog timer will be enabled, phone will be restart after +/- 30 seconds. You will see software says IMEI ?????????

    Make ASK: make “ask” file to be calculated become RPL.

    This operation is used after you change UEM and want same IMEI number with your phone previously (IMEI at back cover sticker), or you have change flash IC but don’t have back up for this.
    Tick “UEM Changed” in order to get DATA2 calculation also,
    otherwise ASK will be calculated only for Flash IC / DATA1.

    Write RPL (reply) :

    Because there are 2 IMEI in DCT4 phone, RPL may contains DATA1 only or DATA1 & DATA2. You can open it with Notepad/Wordpad.
    RPL from back up RPL 208 contains only DATA1, will be uploaded to flash IC.
    RPL from ASK calculation can be contains 2 data (remember about thick “UEM changed” when make ASK), one will be uploaded to flash IC : DATA1, and the other one will be uploaded to UEM: DATA2.
    If you changed UEM, DATA2 will be wrote and become OTP IMEI. No problem if RPL contains 2 data but you did not change UEM, as long as DATA1 and DATA2 are synchronized, phone will be normal.

    ASIC : Application Specific Integrated Circuit
    class of DCT4 phone,
    ASIC 2
    ASIC 5 - WD2
    ASIC 6 - TIKU BT
    ASIC 7
    ASIC 11
    If you changed UEM and do not want to calculated RPL, you can use “free supplied rpl” that come with software installation, but you have to write RPL with same ASIC to your phone.

    IMEI Patch:

    this will “patched” IMEI Plain, IMEI that showed by pressing *#06#, with desired IMEI that you want. Patch options only work for DCT4 ASIC2.
    And this only work for normal phone, means patch WILL NOT SOLVE problem IMEI ????????? that ’caused by DATA1 corrupted.
    If you try this with phone that have problem IMEI ?????????, Watchdog timer will be enabled, and your phone will restart after +/- 30 seconds.

    IMEI Save: back up PM 208 as RPL

    Unlock : Initialize SIM Lock , needed after write RPL

    Read UEM : Read UEM IMEI

    If you have phone with IMEI ?????????, check also whether UEM IMEI still good.

    If yes, read ASK, calculate ASK to RPL, and write RPL.
    But if UEM IMEI also damage, you have to Change UEM.
    Service Operations tab: (use Service button to execute)
    Make sure you phone able to enter local and test mode for this service.
    If not, check the cable or maybe phone have hardware problem.
    Read, Write, and erase PM : look above about PM.

    Self Test : test some phone conditions via software.

    Always use this feature if your phone has “Contact Service” problem that can not be solve with erasing and flashing.

    Disp Test : LCD test.

    Upload TUN : RF value for CDMA phone was saved with file named *.tun.

    Factory Setting: reset the phone to factory settings

    Prod. Manager :

    Read or change/write some value that saved in PM area:
    - Product code
    - HW version : Hardware Version : please be careful edit this for RM-72 - 6230i, ’cause PPM and CNT flash file was different between old and new HW version.
    - Order Number
    - Production SN
    - Manufacture Month : in phone showed by typing *#warranty#
    File System Format:
    Format User Area of the phone, user data will be lost.
    Remember that WD2 have different File System with DCT4 TIKU as example.
    WD2 = Symbian EPOC, Drive for User Area : C
    DCT4 TIKU : FILE2 , use Format Type : Low Level Format, and type : NAND
    So, if software can not detect File System correctly, try making Full Factory before execute this again.
    User Code Edit:
    Read Security Code which saved at PM filed number 35.
    Upload and Read PP:
    please look above “Product Profile”

    ADC Read :

    Analog to Digital Converter : some Self Test about phone battery, charger,
    etc

    Fun Explorer :

    About exploring JAVA application in DCT4 phone.

    Warranty Reset :

    look above about Warranty.

    Phone Mode:

    (?) read phone status
    change phone mode to
    Local Mode
    Test Mode
    Normal Mode

    Communication Mode:

    F-Bus cable : flasher cable

    USB: DKU-2/CA-53, when you connect DCT4 TIKU with this cable, you will be able to make some operation like : make Full factory, Init SIM Lock, etc, but not for flashing.
    ——————————————————————–
    Flashing DCT4 APE phone : 9300, 9500, and 7710:
    connect both F-Bus cable and USB cable (DKU-2 CA-53) to phone.
    when you make CHK for this phone, System Tray in Windows will give warning about “USB DEVICE NOT RECOGNIZE”, this is normal, and this must be happen.
    If you don’t get this warning, you need to check again USB connection to phone, otherwise phone may have hardware problem.
    During flashing process windows will install drivers needed for flashing this phone.
    ================================================== =================
    BB5 tab

    BB5 phone :

    BB : Base Band

    Single chip : have only CMT processor. example : 6270, 62880, etc

    Dual chip : have two processor, CMT (cellular Mobile telephone) and APE
    (Application Processor Engine) example : 6630, 6680, N70, etc.

    Communication Mode:

    F-BUS cable : use only 7 pins cable for flashing with JAF box.
    Make sure your phone can enter Local or Test Mode !!!
    If not, maybe you need to check your cable, and then modified it, if not suitable with JAF specification.

    1. NEVER EVER try putting 9v battery in F-BUS cable though your cable has this connector !!!

    2. Resistance between BSI-GND must be 68k ohms, if less than it, maybe you will find “error sync the phone when make “CHK”

    3. Resistance in BSI serial must be 5,1k(5k1) or 7,5k(7k5) ohms. Otherwise your phone can not enter Local / Test Mode.

    4. Make sure VPP line from RJ45 connected to RX2 in phone.
    Never use cable that connected VPP line in RJ45 with VPP in phone, you will get error something like “Error APE get id”
    I don’t give explanation about P-KEY and UFS Box, because newer BB5 phone with RAPIDO processor doesn’t supported by UFS Box.

    USB : all (alive) BB5 phone supported by USB flashing, you may use DKU-2 or CA-53, but some types needs DKE-2/mini USB for this operation. make sure your battery fully charged, or charge it with an original charger before start flashing.
    When you flash phone and software give error warning “error getting flash id”,
    put sim card inside, do not select offline mode, and flash the phone.

    Note : make sure you disable all connection in PC Suite (if you installed Nokia PC Suite software in your PC) when using this service.

    Dead USB :

    Few types of BB5 with single chips supported by “Dead USB flashing”.
    Choose flash file manually, connect USB cable to phone, and when software give command to “press the power now”, press switch on/off briefly. In windows systems try, will show “Nokia USB ROM”, and windows will install the driver automatically.
    For some types, successfully dead USB flashing will revive the phone, but gallery content will be empty, so you need to flash again with USB as normally.

    Downgrade :

    This option based on Dejan’s trick to be able to flash a working/normal BB5 phone with lower version.
    Maybe not all BB5 supported by this option. So, if you try downgrade and the phone become dead, flash again with latest/highest firmware version.

    CRT 308:

    PM field number 308 contains SIM Lock data, make sure your phone can enter Local Mode before flash, in order to make successful back up.
    If something wrong after flashing process and SIM Lock Data become corrupted, use Write PM and choose this back up to be written to the phone. Your sim lock state will back like before flashing.

    CRT BKP: Certificate Back Up, saved as *.RPL.

    Skip APE: skip APE flashing.

    SX4 Authority :

    BB5 phones have protection for writing RF(1 ) and Energy(309, 0×135 in hex) settings in EPROM. Not having those settings in phone, is known as ‘Contact Retailer Problem’, or ‘Security Error’ in Self Test. In order to write those settings phone requires an authorization that only SX4 Smart Card can perform.
    As those cards are hard to get, software can use server support for this authorization.
    To authorize, connect BB5 phone, and power it on.
    Press “SX4 AUTH”. If you have SX4 card connected to PC, software will use it to compute the authorization password and send it to phone.
    If you don’t have card, software will connect to server to compute authorization password.
    If this process have sucessfuly done, Write PM to the phone without field number 308.
    ================================================== =============
    Card Life Counter :

    this will decrease every time you flash a phone, if yourCard Life Counter almost empty / almost 0%, go to P-KEY tab and press Update P-KEY to make it full again / 100%.
    This operation need internet connection, & make sure you have disabled your firewall.

    Update Loaders:

    FIA = Flash Identification Address are files that needed for flashing, to identify

    MCU ID and Flash Files which suitable with phones. If you press this, software will check whether new version from support site exist and replace your flash loaders with new one if you download it.

    Technical source: IPH

    ================================================== ======
    DEMONSTRATION LOGS FOR 'NOKIA 6300:RM 217":

    What will be logged while downgrading your phone:

    Code:
    JAF version 1.98.62
    Detected PKEY: 90009A4F
    Card life counter: 99.99%
    P-key nokia module version 01.02
    FBUS INTERFACE NOT CONNECTED!!!
    USB Cable Driver version: 6.86.15.0
    Changing mode...Done!
    FILES SET FOR FLASHING:
    MCU Flash file: NONE
    PPM Flash file: NONE
    CNT Flash file: NONE
    APE Variant file: NONE
    Searching for JAF saved location of ini...
    Checking path: C:\Program Files\Nokia\Phoenix\Products\RM-217\
    Searching for default location of ini...
    Checking path: C:\Program Files\Common Files\Nokia\DataPackage\Products\RM-217\
    Searching for JAF saved location of ini...
    Checking path: C:\Program Files\Nokia\Phoenix\Products\RM-217\
    Scanning ini files...
    Searching for default location of ini...
    Checking path: C:\Program Files\Common Files\Nokia\DataPackage\Products\RM-217\
    Checking path: C:\Program Files\Nokia\Phoenix\Products\RM-217\
    FILES SET FOR FLASHING:
    MCU Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.mcusw
    PPM Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.ppm_a
    CNT Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.image_a
    APE Variant file: NONE
    Languages in ppm: English,German,Finish,Swedish,Danish,Norwegian,Icelandic
    Backing up CRT...
    Detected P-KEY: 90009A4F
    P-key nokia module version 01.02
    Init usb communication...
    Reading IMEI...
    C:\Program Files\ODEON\JAF\ProgData\359538017854627_CRT_backup_2144191.pm
    Done!
    Backup CRT OK!
    Preparing for downgrade...
    Detected P-KEY: 90009A4F
    P-key nokia module version 01.02
    Init usb communication...
    Phone ready for downgrade!
    Detected P-KEY: 90009A4F
    P-key nokia module version 01.02
    Init usb communication...
    Searching for phone...Found
    Reading SW version...06.60 
    Reading battery value...3999 mV
    Init usb flashing...
    Reading flashid... 128k flash detected.
    CMT: 220800EC <=> SAMSUNG (SEC) -> K8F5615ETM/K5G5629ATD
    APE: 00000000 <=> Flash -> not detected
    Verifing ADL communication... Status byte 2
    Scanning selected flash files...
    Found CMT ULO server in flash file...
    ADL->Loader: Update Application Loader -> Single Chip
    Loader len: 240192, CHK: 0x26DB
    ADL -> Sending loader...
    ................................................................................
    ..............................................
    Waiting for the phone to boot...
    Searching for phone...
    Status byte: 0400
    Selecting CMT flash...
    Result: 0000
    Phone is in flash mode...
    CMT blocks: 1408, APE blocks: 0
    Erasing cmt...
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.mcusw...
    Erasing cmt zone 00000000 - 000006BF ... Erase result: 0000
    Erasing cmt zone 000006C0 - 0001FFFF ... Erase result: 0000
    Erasing cmt zone 00020000 - 0007FFFF ... Erase result: 0000
    Erasing cmt zone 00080000 - 000DFFFF ... Erase result: 0000
    Erasing cmt zone 00100000 - 001FFFFF ... Erase result: 0000
    Erasing cmt zone 00200000 - 0031FFFF ... Erase result: 0000
    Erasing cmt zone 00320000 - 0105FFFF ... Erase result: 0000
    Erasing cmt zone 01060000 - 01067FFF ... Erase result: 0000
    Erasing cmt zone 01068000 - 0107FFFF ... Erase result: 0000
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.ppm_a...
    Erasing cmt zone 01080000 - 015FFFFF ... Erase result: 0000
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.image_a...
    Erasing cmt zone 01600000 - 01FDFFFF ... Erase result: 0000
    Send CMT CFG...
    Writing cmt...
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.mcusw...
    Sending CMT HASH for NOLO
    Sending CMT HASH for KEYS
    Sending CMT HASH for PRIMAPP
    Sending CMT HASH for PASUBTOC
    cmt->PAPUB_CERTIFICATE_DATA_BB5 block detected
    cmt->PAPUB_CERTIFICATE_DATA_BB5 block detected, sending... 
    Sending CMT HASH for UPDAPP
    Sending CMT HASH for DSP0
    Sending CMT HASH for MCUSW
    Sending CMT HASH for PMM_CONF
    Sending CMT HASH for SBIF_CONF
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.ppm_a...
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__05.50.image_a...
    Writing 128k page converted flash...
    Rebooting...
    Restarting CMT...
    Pooling phone...
    MCUSW: V 05.50
    14-08-07
    RM-217
    (c) Nokia.     
    APESW: (null)
    VariantSW: (null)
    Prodcode: 0537631
    Done!
    What will be logged while recovering a dead phone:

    Code:
    JAF version 1.98.62
    Detected PKEY: 9000A86B
    Card life counter: 99.99%
    P-key nokia module version 01.02
    FBUS INTERFACE NOT CONNECTED!!!
    USB Cable Driver version: 6.86.15.0
    Changing mode...Done!
    FILES SET FOR FLASHING:
    MCU Flash file: NONE
    PPM Flash file: NONE
    CNT Flash file: NONE
    APE Variant file: NONE
    Searching for JAF saved location of ini...
    Checking path: C:\Program Files\Nokia\Phoenix\Products\RM-217\
    Searching for default location of ini...
    Checking path: C:\Program Files\Common Files\Nokia\DataPackage\Products\RM-217\
    Searching for JAF saved location of ini...
    Checking path: C:\Program Files\Nokia\Phoenix\Products\RM-217\
    Scanning ini files...
    Searching for default location of ini...
    Checking path: C:\Program Files\Common Files\Nokia\DataPackage\Products\RM-217\
    Checking path: C:\Program Files\Nokia\Phoenix\Products\RM-217\
    FILES SET FOR FLASHING:
    MCU Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.mcusw
    PPM Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.ppm_a
    CNT Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.image_a
    APE Variant file: NONE
    Languages in ppm: English,German,Finish,Swedish,Danish,Norwegian,Icelandic
    Detected P-KEY: 9000A86B
    P-key nokia module version 01.02
    Init usb communication...
    PRESS POWER ON NOW!
    Searching for phone...Found
    Sending RAW loader...
    Using 06.02.002
     Elf2flash 02.33.000 RAW loader...
    Patching RAW boot step1...
    Patching RAW boot step3...
    Sending RAW Loader...
    ...................Loader Sent!
    Stage 2 starting...............................................................Loader Sent!
    Stage 3 starting..................Phone prepared OK!
    Waiting for the phone to boot...
    Searching for phone...
    Status byte: 8000
    Selecting CMT flash...
    Result: 0000
    Phone is in flash mode...
    CMT blocks: 1424, APE blocks: 0
    Erasing cmt...
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.mcusw...
    Erasing cmt zone 00000000 - 000006BF ... Erase result: 0000
    Erasing cmt zone 000006C0 - 0001FFFF ... Erase result: 0000
    Erasing cmt zone 00020000 - 0007FFFF ... Erase result: 0000
    Erasing cmt zone 00080000 - 000DFFFF ... Erase result: 0000
    Erasing cmt zone 00100000 - 001FFFFF ... Erase result: 0000
    Erasing cmt zone 00200000 - 0031FFFF ... Erase result: 0000
    Erasing cmt zone 00320000 - 0105FFFF ... Erase result: 0000
    Erasing cmt zone 01060000 - 01067FFF ... Erase result: 0000
    Erasing cmt zone 01068000 - 0107FFFF ... Erase result: 0000
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.ppm_a...
    Erasing cmt zone 01080000 - 015FFFFF ... Erase result: 0000
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.image_a...
    Erasing cmt zone 01600000 - 01FDFFFF ... Erase result: 0000
    Send CMT CFG...
    Writing cmt...
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.mcusw...
    Sending CMT HASH for NOLO
    Sending CMT HASH for KEYS
    Sending CMT HASH for PRIMAPP
    Sending CMT HASH for PASUBTOC
    cmt->PAPUB_CERTIFICATE_DATA_BB5 block detected
    cmt->PAPUB_CERTIFICATE_DATA_BB5 block detected, sending... 
    Sending CMT HASH for UPDAPP
    Sending CMT HASH for DSP0
    Sending CMT HASH for MCUSW
    Sending CMT HASH for PMM_CONF
    Sending CMT HASH for SBIF_CONF
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.ppm_a...
    Processing C:\Program Files\Nokia\Phoenix\Products\RM-217\rm217__06.60.image_a...
    Rebooting...
    Finishing CMT session...
    Restarting CMT...
    Pooling phone...
    MCUSW: V 06.60
    21-05-08
    RM-217
    (c) Nokia.     
    APESW: (null)
    VariantSW: (null)
    Prodcode: 0537631
    Done!

    DOWNLOADS:

    JAF 1.98.62 (+Crack):

    http://rapidshare.com/files/186146404/JAF.1.98.62.rar

    Firmwares for your phone:

    www.blue-nokia.com/obnoxy/index02.html

    ================================================== =======
    UPDATE: DO NOT attempt a downgrade on N95/N82 from 30.xx to 20.xx or you will kill your phone.Though you can recover a dead one via this method.
    ================================================== =======
    Hope this was in any way useful to you.
    Last edited by megtheabyss; 07-22-2009 at 07:48 PM. Reason: Daily update

  2. #2
    Good PosteR
    Reputation

    Join Date
    May 2009
    Age
    20
    Posts
    445
    Thanks
    0
    Thanked 2 Times in 2 Posts
    Rep Power
    5

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    MOST COMPLETE guide i've ever seen respect to you man!!!

  3. #3
    DotSIS NewBie
    Reputation
    subrata440's Avatar
    Join Date
    Dec 2005
    Posts
    88
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    5

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    Thanks for the software.
    Friend I have Nokia N95 8GB (RM-320) with latest Firmware version 31.0.015 but I need to Downgrade to V20.0.016. So please give me the tutorial how to downgrade N95 8GB with DKU-2, USB Cable.

  4. #4
    DotSIS Member
    Reputation Reputation
    megtheabyss's Avatar
    Join Date
    Feb 2009
    Location
    Kolkata
    Age
    20
    Posts
    116
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    3

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    Quote Originally Posted by subrata440 View Post
    Thanks for the software.
    Friend I have Nokia N95 8GB (RM-320) with latest Firmware version 31.0.015 but I need to Downgrade to V20.0.016. So please give me the tutorial how to downgrade N95 8GB with DKU-2, USB Cable.

    Yes,most probably you can (VERY VERY few phones somehow give errors when downgraded).Just go through the above terminologies to understand how to use
    JAF.If you do go through the entire thread,you WILL make out how to downgrade your N95 without any 1-2-3 guide.I wanted to make it a generalised thread,thats why I did not mention the process for a single SPECIFIC phone.

    Good luck!

  5. #5
    DotSIS NewBie
    Reputation
    subrata440's Avatar
    Join Date
    Dec 2005
    Posts
    88
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    5

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    Friend I am not an mobile expert. I don't want to take any risk. So kindly please please please help me to downgrade my phone. Please give me a step by step guide I will be very great full to you. Please friend please HELP me.

  6. #6
    DotSIS Member
    Reputation Reputation
    megtheabyss's Avatar
    Join Date
    Feb 2009
    Location
    Kolkata
    Age
    20
    Posts
    116
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    3

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    Quote Originally Posted by subrata440 View Post
    Friend I am not an mobile expert. I don't want to take any risk. So kindly please please please help me to downgrade my phone. Please give me a step by step guide I will be very great full to you. Please friend please HELP me.
    After your reply,I googled my way through for experiences people had while attempting a downgrade on N95 from 30.xx to 20.xx through JAF.All of them had the same experience:They killed their phone.Nokia has possibly implemented a new 'anti-downgrade' thing on their newer firmwares of N95.Everything goes fine until you see this error while attempting a downgrade on it:

    "Error in MSG id...
    Error in APE get id..."

    That is 'possibly' not overcomeable.So ,at present,there is no possible downgrade on N95(Sorry but its a fact,no one can do anything about it).

    I have downgraded my E51 successfully by using this method,so it is feasible for majority of phones (exceptions have arisen,like N95 with the NEWEST firmware).Very much sorry to disappoint you,but do not DOWNGRADE in this case if you dont want a dead phone.

  7. #7
    DotSIS NewBie
    Reputation
    subrata440's Avatar
    Join Date
    Dec 2005
    Posts
    88
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    5

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    Ok friend thanks for the reply. I think it will be better I should take to Nokia Care Office.

  8. #8
    Registered At DotSIS
    Reputation

    Join Date
    Jan 2009
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    Can I downgrade my N78 with this? I have 21.002 and I want 12.046.
    Can U write a simpled tutorial how to do this.

    21.002 sucks, my umsic player freezes when I use fm transmitter, camera cant zoom,...

    Thanks

  9. #9
    DotSIS Member
    Reputation Reputation
    megtheabyss's Avatar
    Join Date
    Feb 2009
    Location
    Kolkata
    Age
    20
    Posts
    116
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    3

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    Quote Originally Posted by azrel View Post
    Can I downgrade my N78 with this? I have 21.002 and I want 12.046.
    Can U write a simpled tutorial how to do this.

    21.002 sucks, my umsic player freezes when I use fm transmitter, camera cant zoom,...

    Thanks
    Yes,'apparently' its possible.Please go through the terminologies above to understand the correct settings to be made.I have a friend who has downgraded N78 from 13.xx to 12.xx.Though,you probably would have success too.But in case that you fail while flashing(that will occur if you dont have the correct drivers and settings,please dont blame me for that),dont panic,you can still recover your phone without problems (all info on this thread).So,give it a try (if you are desperate to downgrade).But perform all settings under full awareness

    When everything goes well,here is the log for your convenience:

    Code:
    JAF version 1.98.62 
    Detected PKEY: 9000AAC9 
    Card life counter: 99.99% 
    P-key nokia module version 01.02 
    FBUS INTERFACE NOT CONNECTED!!! 
    USB Cable Driver version: 6.83.9.0 
    Changing mode ... Done! 
    Detected P-KEY: 9000AAC9 
    P-key nokia module version 01.02 
    Init usb communication ... 
    Reading product code ... 
    Product Code: 0564859 
    Searching for JAF saved location of ini ... 
    Checking path: C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ 
    Searching for default location of ini ... 
    Checking path: \ Products \ RM-235 \ 
    Searching for JAF saved location of ini ... 
    Checking path: C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ 
    Scanning ini files ... 
    Searching for default location of ini ... 
    Checking path: \ Products \ RM-235 \ 
    Checking path: C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ 
    FILES SET FOR FLASHING: 
    MCU Flash file: C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_prd.core.fpsx 
    PPM Flash file: C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_014_prd.language.fpsx 
    CNT Flash file: C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_051.1_prd.customer.fpsx 
    APE Variant file: C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_002_000_U001.uda.fpsx 
    Backing up CRT ... 
    Detected P-KEY: 9000AAC9 
    P-key nokia module version 01.02 
    Init usb communication ... 
    Reading IMEI ... This is what I like to hide the serial number 
    C: \ Program Files \ ODEON \ JAF \ ProgData \ 3520570220XXXXX _CRT_backup_217291.pm 
    Done! 
    Backup CRT OK! 
    Preparing for downgrade ... 
    Detected P-KEY: 9000AAC9 
    P-key nokia module version 01.02 
    Init usb communication ... 
    Phone ready for downgrade! 
    Detected P-KEY: 9000AAC9 
    P-key nokia module version 01.02 
    Init usb communication ... 
    Searching for phone ... Found 
    Reading SW version ... ICPR71_08w44 20.149 
    Reading battery value ... 4114 mV 
    Init usb flashing ... 
    Reading flashid ... 
    CMT: 004000EC <=> SAMSUNG (SEC) -> KAT00F00RA 
    APE: 00000000 <=> Flash -> not detected 
    Verifing ADL communication ... Status byte 7 
    Rebooting to flash mode ... 
    Waiting for the phone to reboot ... 
    Searching for phone ... 
    Sending RAW loader ... 
    Using 007.016.022 
    Elf2flash 07.50.000 
    CMT RAW loader ... 
    Sending RAW Loader ... 
    .................... Loader Sent! 
    Stage 2 starting ............. Phone prepared OK! 
    Waiting for the phone to boot ... 
    Searching for phone ... 
    Status byte: 8000 
    Selecting CMT flash ... 
    Result: 0000 
    Phone is in flash mode ... 
    CMT blocks: 874, APE blocks: 0 
    Erasing cmt ... 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_prd.core.fpsx ... 
    Erasing cmt zone 00040000 - 00082FFF ... Erase result: 0000 
    Erasing cmt zone 00083400 - 003FFFFF ... Erase result: 0000 
    Erasing cmt zone 00400000 - 0095FFFF ... Erase result: 0000 
    Erasing cmt zone 00C60000 - 0A87FFFF ... Erase result: 0000 
    Partition result: 0014 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_014_prd.language.fpsx ... 
    Erasing cmt zone 07E60000 - 09C7FFFF ... Erase result: 0000 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_051.1_prd.customer.fpsx ... 
    Erasing cmt zone 09C80000 - 0A87FFFF ... Erase result: 0000 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_002_000_U001.uda.fpsx ... 
    Erasing cmt zone 0A880000 - 0F71FFFF ... Erase result: 0000 
    Send CMT CFG ... 
    Writing cmt ... 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_prd.core.fpsx ... 
    Sending CMT HASH for ADA 
    Sending CMT HASH for KEYS 
    Sending CMT HASH for PRIMAPP 
    Sending CMT HASH for RAP3NAND 
    Sending CMT HASH for PASUBTOC 
    cmt-> PAPUB_CERTIFICATE_DATA_BB5 block detected, sending ... 
    Sending CMT HASH for SOS * UPDAPP 
    Sending CMT HASH for SOS * DSP0 
    Sending CMT HASH for SOS * ISASW 
    Sending CMT HASH for SOS + CORE 
    Sending CMT HASH for SOS + ROFS1 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_014_prd.language.fpsx ... 
    Sending CMT HASH for SOS + ROFS2 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_051.1_prd.customer.fpsx ... 
    Sending CMT HASH for SOS + ROFS3 
    Processing C: \ Program Files \ Nokia \ Phoenix \ Products \ RM-235 \ RM-235_12.046_002_000_U001.uda.fpsx ... 
    Rebooting ... 
    Finishing CMT session ... 
    Restarting CMT ... 
    Pooling phone ... 
    MCUSW: V ICPR71_08w24.2 
    25-06-08 
    RM-235 
    (c) Nokia 
    APESW: 12.046 
    VariantSW: 12.04612.046.014.112.046.051.1 
    Prodcode: 0564859 
    Done!
    Good luck!

  10. #10
    DotSIS NewBie
    Reputation Reputation
    jmichaelm's Avatar
    Join Date
    Feb 2008
    Location
    perlas ng silangan, Pilipinas
    Age
    22
    Posts
    87
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    3

    Re: Complete Guide for DOWNGRADING firmware or REPAIRING a Dead phone

    wow very very awesome information.. but after reading some feedback here, i just dont get the idea of downgrading their mobile phones? for what?

+ Reply to Thread
Page 1 of 8
1 2 3 4 5 6 7 ... LastLast

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts