Hello,
how can i completely remove certification from rom (wm2005) prior to flashing?
The registry tweak only disables the security prompt.
This is not enough, as some dll's won't load at startup.
I know this has been done with the himalaya roms but how???
Thanks
i would realy appreciate some input here.
Thanks
i will join the in the hunt .
I found a post from maimach
Find in nk.nba bytes:
F0 40 2D E9 08 D0 4D E2 01 70 A0 E1 00 60 A0 E1 7C 41 9F E5
patch their beginning to:
01 00 A0 E3 1E FF 2F E1
and find F0 4F 2D E9 2C D0 4D E2 03 90 A0 E1 02 A0 A0 E1 01 B0 A0 E1 00 50 B0 E1 00 40 A0 E3 0C 40 8D E5
patch to:
01 00 A0 E3 1E FF 2F E1
find F0 43 2D E9 50 D0 4D E2 03 80 A0 E1 02 50 A0 E1 01 60 A0 E1 00 90 A0 E1 38 E1 9F E5
patch to:
01 00 A0 E3 1E FF 2F E1
first is CertVerify function, second is VerifyFile, third is VerifyCab. Only the first patch is necessary.
Click to expand...
Click to collapse
But when my prophet boots, my screen starts to flicker and it just hanngs at the first screen.
Any comments?
Related
can someone assist me in changing the nk.exe in a way that allows me to change the deviceid from PU10 to HERM100
i succeded in hexediting the hk.nba from PU10 to HERM with the confirmation that Getdevice data recognize it as HERM
http://wiki.xda-developers.com/index.php?pagename=GetDeviceData
there are 2 places in the nk.nba where the device type is found
00007074h: 48 00 45 00 52 00 4D ; H.E.R.M
00316c74h: 48 00 45 00 52 00 4D ; H.E.R.M
i need to get H.E.R.M.1.0.0 instead (6 bytes to insert)
00007050h: 2C 00 25 00 64 00 2C 00 20 00 4E 00 61 00 6D 00 ; ,.%.d.,. .N.a.m.
00007060h: 65 00 20 00 69 00 73 00 20 00 25 00 73 00 0D 00 ; e. .i.s. .%.s...
00007070h: 0A 00 00 00 48 00 45 00 52 00 4D 00 00 00 00 00 ; ....H.E.R.M.....
00007080h: 4F 45 4D 47 65 74 43 50 4C 44 5F 47 50 49 4F 28 ; OEMGetCPLD_GPIO(
after dumping the rom including the boot XIP i found that the nk.exe contains this data.
the reason to do it is to "help" bbconnect to recognize it as a hermes
anyone can assist me ?
It seems Kies use OBEX...
AT+SYNCML=MOBEXSTART
First time I saw OBEX was in Brew Mobile Commander in 2006.
Also there was an Plugin for Total Commander...
But this seems not work with S8500.
Other used Protocol is TFS... Samsungs Test Commands. For instance in TkFileExplorer_2.2.exe used.
Hmmm. I need more info/practice about OBEX...
Best Regards
TFS - I saw references to that on the boot loader stuff that was decrypted elsewhere on this forum... Tiny File System, Transparent File System.....?????
New year... old questions.
In Kies you can find several OBEX Commands... like:
m-obex/system/memory
m-obex/application/count
apps_c...
m-obex/fs/info
m-obex/fs/mem_size
In bada 2.0 it seems removed obex... replaced by other stuff...
Anyway. For learning I wish I could use obex Commands successfully.
At the moment no idea how.
Maybe someone could help me.
Best Regards
Edit 1.
Found something via Google...
http://wammu.eu/docs/manual/protocol/m-obex.html
But I sent on XXJL2 AT Command, but can't see any results...
AT+SYNCML=MOBEXSTART
For instance I use WinComm...
AT Commands work on my Port 5...
But if I send this:
AT+SYNCML=MOBEXSTART
AT Commands not more work on COM 5...
Also I get no answer for obex Commands like this:
m-obex/application/count
Is obex open new port?
Or if I sent on 5 I should receive on COM 5 ?
Again many Questions.
Thanx for reading.
Best Regards
todo: implement it in bterm
Code:
Request: AT
41 54 0D 0A
Answer: AT OK
41 54 0D 0D 0A 4F 4B 0D 0A
Request: ATZ
41 54 5A 0D 0A
Answer: ATZ OK
41 54 5A 0D 0D 0A 4F 4B 0D 0A
Request: AT+SYNCML=MOBEXSTART
41 54 2B 53 59 4E 43 4D 4C 3D 4D 4F 42 45 58 53 54 41 52 54 0D 0A
Answer: AT+SYNCML=MOBEXSTART OK
41 54 2B 53 59 4E 43 4D 4C 3D 4D 4F 42 45 58 53 54 41 52 54 0D 4F 4B 0D 0A
Request:
80 00 0F 11 00 20 00 46 00 08 4D 4F 42 45 58
Answer:
A0 00 14 10 00 20 00 CB 00 00 00 01 4A 00 08 4D 4F 42 45 58
#########################################
# Additional command goes here...
#########################################
Request:
81 00 03
Answer:
A0 00 03
Request: ATZ
41 54 5A 0D 0A
Answer: ATZ OK
41 54 5A 0D 0D 0A 4F 4B 0D 0A
commands examples
Code:
Request: m-obex/connection_packet
82 00 23 CB 00 00 00 01 42 00 1B 6D 2D 6F 62 65 78 2F 63 6F 6E 6E 65 63 74 69 6F 6E 5F 70 61 63 6B 65 74
Answer:
A0 00 03
Request: m-obex/security/privacylock
83 00 27 CB 00 00 00 00 42 00 1F 6D 2D 6F 62 65 78 2F 73 65 63 75 72 69 74 79 2F 70 72 69 76 61 63 79 6C 6F 63 6B 00
Answer:
A0 00 12 C3 00 00 00 02 4C 00 05 00 00 49 00 05 00 00
Request: m-obex/fs/privacy_lock
83 00 22 CB 00 00 00 00 42 00 1A 6D 2D 6F 62 65 78 2F 66 73 2F 70 72 69 76 61 63 79 5F 6C 6F 63 6B 00
Answer:
A0 00 0D C3 00 00 00 02 49 00 05 4E 4F *
Request: m-obex/application/count
83 00 27 CB 00 00 00 00 42 00 1C 6D 2D 6F 62 65 78 2F 61 70 70 6C 69 63 61 74 69 6F 6E 2F 63 6F 75 6E 74 00 4C 00 03
Answer:
A0 00 14 C3 00 00 00 04 4C 00 05 00 00 49 00 07 2C 00 00 00
Request: m-obex/system/imsi
83 00 21 CB 00 00 00 00 42 00 16 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 69 6D 73 69 00 4C 00 03
Answer: IMSI ;)
A0 00 1F C3 00 00 00 0F 4C 00 05 00 00 49 00 12 .......
Request: ƒm-obex/system/mnc
83 00 20 CB 00 00 00 00 42 00 15 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 6D 6E 63 00 4C 00 03
Answer: 02
A0 00 12 C3 00 00 00 02 4C 00 05 00 00 49 00 05 30 32
Request: ƒm-obex/system/csc
83 00 20 CB 00 00 00 00 42 00 15 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 63 73 63 00 4C 00 03
Answer: S8500OXAJID
A0 00 1B C3 00 00 00 0B 4C 00 05 00 00 49 00 0E 53 38 35 30 30 4F 58 41 4A 49 44
Request: m-obex/system/openapiversion
83 00 2B CB 00 00 00 00 42 00 20 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 6F 70 65 6E 61 70 69 76 65 72 73 69 6F 6E 00 4C 00 03
Answer: 1.2.0_1009152352_LIS_S8500XXJID_XEO
A0 00 33 C3 00 00 00 23 4C 00 05 00 00 49 00 26 31 2E 32 2E 30 5F 31 30 30 39 31 35 32 33 35 32 5F 4C 49 53 5F 53 38 35 30 30 58 58 4A 49 44 5F 58 45 4F
Request: m-obex/application/getinstallsetting
83 00 33 CB 00 00 00 00 42 00 28 6D 2D 6F 62 65 78 2F 61 70 70 6C 69 63 61 74 69 6F 6E 2F 67 65 74 69 6E 73 74 61 6C 6C 73 65 74 74 69 6E 67 00 4C 00 03
Answer:
A0 00 14 C3 00 00 00 04 4C 00 05 00 00 49 00 07 01 00 00 00
---------- Post added at 06:31 PM ---------- Previous post was at 06:29 PM ----------
PS. tested on bada 2.0
Thank you very much.
I got it now.
Tested on bada 1.x
Older then XXJL2 seems to have other syntax...
But I can confirm work also on XXKL6.
Wow. Every little mistake have lead to no further connection...
Best Regards
Oh "surprise"...
Again obelix power...
m-obex/system/restore/start
.
.
See here:
http://forum.xda-developers.com/showpost.php?p=21541765&postcount=4
Best Regards
When I was messing with BitPim earlier, I tried out the Protocol Analyser and got this:
18:52:09.717 Other CDMA Phone: Listing files in dir: '.efs_private'
18:52:09.717 Other CDMA Phone: sendbrewcommand Data - 20 bytes
<#! phones.p_brew.listfilerequest !#>
00000000 59 0b 00 00 00 00 0d 2e 65 66 73 5f 70 72 69 76 Y.......efs_priv
00000010 61 74 65 00 ate.
18:52:09.765 Other CDMA Phone: brew response Data - 17 bytes
<#! phones.p_brew.listfileresponse !#>
00000000 13 0b 00 00 00 0d 2e 65 66 73 5f 70 72 69 76 61 .......efs_priva
00000010 74 t
18:52:09.765 Other CDMA Phone: Failed to list files in dir .efs_private
18:52:09.780 Other CDMA Phone: Listing subdirs in dir: '.efs_private'
18:52:09.780 Other CDMA Phone: X recurse=0
18:52:09.780 Other CDMA Phone: sendbrewcommand Data - 20 bytes
<#! phones.p_brew.listdirectoryrequest !#>
00000000 59 0a 00 00 00 00 0d 2e 65 66 73 5f 70 72 69 76 Y.......efs_priv
00000010 61 74 65 00 ate.
18:52:09.780 Other CDMA Phone: brew response Data - 17 bytes
<#! phones.p_brew.listdirectoryresponse !#>
00000000 13 0a 00 00 00 0d 2e 65 66 73 5f 70 72 69 76 61 .......efs_priva
00000010 74 t
18:52:09.780 Other CDMA Phone: Failed to list dir .efs_private
18:52:11.015 Other CDMA Phone: Listing files in dir: 'CGPS_ME'
18:52:11.015 Other CDMA Phone: sendbrewcommand Data - 15 bytes
<#! phones.p_brew.listfilerequest !#>
00000000 59 0b 00 00 00 00 08 43 47 50 53 5f 4d 45 00 Y......CGPS_ME.
18:52:11.030 Other CDMA Phone: brew response Data - 47 bytes
<#! phones.p_brew.listfileresponse !#>
00000000 59 0b 00 00 00 00 00 0f 00 01 00 93 1a e0 00 00 Y...............
00000010 6c 00 00 bb 1a e0 00 08 16 43 47 50 53 5f 4d 45 l........CGPS_ME
00000020 2f 43 47 50 53 43 65 6c 6c 44 42 46 69 6c 65 /CGPSCellDBFile
18:52:11.030 Other CDMA Phone: sendbrewcommand Data - 15 bytes
<#! phones.p_brew.listfilerequest !#>
00000000 59 0b 01 00 00 00 08 43 47 50 53 5f 4d 45 00 Y......CGPS_ME.
18:52:11.046 Other CDMA Phone: brew response Data - 55 bytes
<#! phones.p_brew.listfileresponse !#>
00000000 59 0b 00 01 00 00 00 0f 00 01 00 93 1a e0 00 2c Y..............,
00000010 00 00 00 bb 1a e0 00 08 1e 43 47 50 53 5f 4d 45 .........CGPS_ME
00000020 2f 43 47 50 53 43 65 6c 6c 44 42 4f 74 61 50 6f /CGPSCellDBOtaPo
00000030 73 52 65 63 6f 72 64 sRecord
18:52:11.046 Other CDMA Phone: sendbrewcommand Data - 15 bytes
<#! phones.p_brew.listfilerequest !#>
00000000 59 0b 02 00 00 00 08 43 47 50 53 5f 4d 45 00 Y......CGPS_ME.
18:52:11.062 Other CDMA Phone: brew response Data - 47 bytes
<#! phones.p_brew.listfileresponse !#>
00000000 59 0b 00 02 00 00 00 0f 00 01 00 93 1a e0 00 3c Y..............<
00000010 00 00 00 bb 1a e0 00 08 16 43 47 50 53 5f 4d 45 .........CGPS_ME
00000020 2f 67 70 73 6f 66 66 73 65 74 73 2e 62 69 6e /gpsoffsets.bin
18:52:11.062 Other CDMA Phone: sendbrewcommand Data - 15 bytes
<#! phones.p_brew.listfilerequest !#>
00000000 59 0b 03 00 00 00 08 43 47 50 53 5f 4d 45 00 Y......CGPS_ME.
18:52:11.078 Other CDMA Phone: brew response Data - 3 bytes
<#! phones.p_brew.listfileresponse !#>
00000000 59 0b 1c Y..
18:52:11.092 Other CDMA Phone: Listing subdirs in dir: 'CGPS_ME'
18:52:11.092 Other CDMA Phone: X recurse=0
18:52:11.092 Other CDMA Phone: sendbrewcommand Data - 15 bytes
<#! phones.p_brew.listdirectoryrequest !#>
00000000 59 0a 00 00 00 00 08 43 47 50 53 5f 4d 45 00 Y......CGPS_ME.
18:52:11.092 Other CDMA Phone: brew response Data - 3 bytes
<#! phones.p_brew.listdirectoryresponse !#>
00000000 59 0a 1c Y..
18:52:12.953 Other CDMA Phone: Getting file contents 'CGPS_ME/gpsoffsets.bin'
18:52:12.953 Other CDMA Phone: sendbrewcommand Data - 27 bytes
<#! phones.p_brew.readfilerequest !#>
00000000 59 04 00 17 43 47 50 53 5f 4d 45 2f 67 70 73 6f Y...CGPS_ME/gpso
00000010 66 66 73 65 74 73 2e 62 69 6e 00 ffsets.bin.
18:52:12.983 Other CDMA Phone: brew response Data - 71 bytes
<#! phones.p_brew.readfileresponse !#>
00000000 59 04 00 00 00 3c 00 00 00 3c 00 ff ff 38 00 00 Y....<...<...8..
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 00 00 00 00 00 00 00 .......
Near the beginning of these, it says things about being unable to open up the .efs_private directory, along with its subfolders. If someone were able to open these, we may find something interesting. Hope this helps!
i got interest in:
p_brew.readfileresponse
if brew lets you load things. i can do test like i did with mtp, through raw USB.
I wondered the same thing about the listing of "brew" there. Can't wait to see if John finds anything.
Using BitPim, which (I believe, from my google searches) references QPST content, the .efs_private folder seems to be specific to QPST. If we're seeing an error trying to list that area, it's probably because bitpim is designed to look for some standard folders, which the Kin does not have.
if we had a worthwhile alternative to BitPim, we may be able to see what's in there. And when you said QPST, does that have anything to do with Qualcomm? I was also looking at the configuration settings for the phone's modem, and i think it mentioned that. So this file could contain hardware, storage, and other files that we could use to break through the restrictions on the phone.
Yes, many phones use Qualcomm hardware or functionality, including Verizon ones. Bitpim simply takes advantage of some common functionality between these phones.
Which file did you mean?
Any idea how Kies identify model? It seems not via AT Commands...
Or I am dumb...
AT+DEVCONINFO
I have used portmon to sniff communication...
Maybe it is the name, what Explorer shows?...
So the mass thingie USB driver...
How for instance S8600 answers in Explorer?
Best Regards
May be it?
http://forum.xda-developers.com/showpost.php?p=11286021&postcount=78
amss.bin I have checked... maybe not.
I have tried MANY combinations... maybe I have something not seen.
Maybe much easier.
Little example how bada Version is checked... Attention, high protection...
extreme hardcoded to prevent change...
2 parts needed...
Part 1:
SystemFS\User\OspSys\registry\buildnumber.ini
Part 2:
SystemFS/User/OspSys/registry/systeminfo.ini
Compare with latest Firmware and you know how to prepare your bada 1.x device for bada 3.0 Apps.
Anyway, I'm blind to manage Kies to work as S8600...
Best Regards
Okay, I've found Original Screenshot of S8600...
But I know where this Text String is stored...
But I can remember, I've tried this... and was not enough...
Maybe I'll try again.
Best Regards
It can be usb device description string in USB driver on phone or PC side (if it's PC side, description is paired with certain PID and VID), try to connect phone to linux in kies mode and use lsusb -a (aint sure if it's -a, anyway the thing is to get verbose info about device)
Hi, I think stune reads the same data that the kies when connected to the terminal.
I mean:
STUNE when you start telling us the firmware version terminal model of our product code, even our imei
Not fully correct
There is something in the PC driver that needs to be changed
You can see this in the driver details
Best Regards
Maybe Kies via Wi-Fi easier...
Not tested yet.
Best Regards
Bus reported device description is sent from device during USB enumeration. So model id is stored in Bada USB module. I'm nearly sure it's unicode string.
Maybe my fault...
AT+PROF="Device
Leads to file device.xml...
Will compare Wave 1, 2, 3 device.xml ...
Best Regards
Edit 1...
Code:
<ModelName value="GT-S8500"/>
<BaseModelName value="GT-S8500"/>
<ProjectName value="Lismore"/>
<FriendlyName value="Lismore"/>
<ProductLineup value="HHP"/>
Code:
<ModelName value="Wave 3"/>
<BaseModelName value="GT-S7250"/>
<ProjectName value="Wave3"/>
<FriendlyName value="Wave3"/>
<ProductLineup value="HHP"/>
Kies now shows other Error
Please, maybe someone can post from S8600 under Explorer...
Remember to remove IMEI...
I think this is MTP device... USB blabla portable Device Driver under Device Manager in Windows...
PS...
Text Samsung... in white Background is editable...
Edit 1.
Hmmm... Wave 2 can't edit ... grey colored...
Screenshot from S8600 would be nice.
Thanx in advance.
why do you think AT+DEVCONINFO is wrong? whole infos including imei in one packet
http://forum.xda-developers.com/showpost.php?p=20497198&postcount=15
Because I've found all files and positions to make 1:1 clone... including IMEI...
But this is not working for Kies.
Kies shows Error, that unsupported device is attached.
Best Regards
error it is kind of progress
what about these ones
Code:
Request: m-obex/connection_packet
82 00 23 CB 00 00 00 01 42 00 1B 6D 2D 6F 62 65 78 2F 63 6F 6E 6E 65 63 74 69 6F 6E 5F 70 61 63 6B 65 74
Answer:
A0 00 03
Request: m-obex/security/privacylock
83 00 27 CB 00 00 00 00 42 00 1F 6D 2D 6F 62 65 78 2F 73 65 63 75 72 69 74 79 2F 70 72 69 76 61 63 79 6C 6F 63 6B 00
Answer:
A0 00 12 C3 00 00 00 02 4C 00 05 00 00 49 00 05 00 00
Request: m-obex/fs/privacy_lock
83 00 22 CB 00 00 00 00 42 00 1A 6D 2D 6F 62 65 78 2F 66 73 2F 70 72 69 76 61 63 79 5F 6C 6F 63 6B 00
Answer:
A0 00 0D C3 00 00 00 02 49 00 05 4E 4F *
Request: m-obex/application/count
83 00 27 CB 00 00 00 00 42 00 1C 6D 2D 6F 62 65 78 2F 61 70 70 6C 69 63 61 74 69 6F 6E 2F 63 6F 75 6E 74 00 4C 00 03
Answer:
A0 00 14 C3 00 00 00 04 4C 00 05 00 00 49 00 07 2C 00 00 00
Request: m-obex/system/imsi
83 00 21 CB 00 00 00 00 42 00 16 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 69 6D 73 69 00 4C 00 03
Answer: IMSI ;)
A0 00 1F .....
Request: ƒm-obex/system/mnc
83 00 20 CB 00 00 00 00 42 00 15 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 6D 6E 63 00 4C 00 03
Answer: 02
A0 00 12 C3 00 00 00 02 4C 00 05 00 00 49 00 05 30 32
Request: ƒm-obex/system/csc
83 00 20 CB 00 00 00 00 42 00 15 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 63 73 63 00 4C 00 03
Answer: S8500OXAJID
A0 00 1B C3 00 00 00 0B 4C 00 05 00 00 49 00 0E 53 38 35 30 30 4F 58 41 4A 49 44
Request: m-obex/system/openapiversion
83 00 2B CB 00 00 00 00 42 00 20 6D 2D 6F 62 65 78 2F 73 79 73 74 65 6D 2F 6F 70 65 6E 61 70 69 76 65 72 73 69 6F 6E 00 4C 00 03
Answer: 1.2.0_1009152352_LIS_S8500XXJID_XEO
A0 00 33 C3 00 00 00 23 4C 00 05 00 00 49 00 26 31 2E 32 2E 30 5F 31 30 30 39 31 35 32 33 35 32 5F 4C 49 53 5F 53 38 35 30 30 58 58 4A 49 44 5F 58 45 4F
Request: m-obex/application/getinstallsetting
83 00 33 CB 00 00 00 00 42 00 28 6D 2D 6F 62 65 78 2F 61 70 70 6C 69 63 61 74 69 6F 6E 2F 67 65 74 69 6E 73 74 61 6C 6C 73 65 74 74 69 6E 67 00 4C 00 03
Answer:
A0 00 14 C3 00 00 00 04 4C 00 05 00 00 49 00 07 01 00 00 00
m-obex/system/csc and
m-obex/system/openapiversion ?
Thank you.
m-obex I have no success because also not enough knowledge.
See here:
http://forum.xda-developers.com/showpost.php?p=20954943&postcount=3
Best Regards
I've somewhere correct sequence to start obex on wave. I will post later
Good afternoon if it will not for anything in this case but I found this on apps_compressed:
x40BF86FF 'kDHd:! eNULL: @ STRENGTH'
0x40BF8765 'eNULL:! ANULL: @ STRENGTH'
0x40BF8784:'/../ cx / source / Xsupplicant / src / auth_methods / eapfast / eapfast.c '
0x40BF889C:'/../ cx / source / Xsupplicant / src / auth_methods / eapfast / eapfast_key.c '
0x40BFAE8C '/ www.openssl.org / support / faq.html'
0x40BFB506: '23456789ABCDEF '
0x40BFC610 '] VOHyrkd'
0x40BFD099: '56789.: AbcdefABCDEF '
ferrloz said:
Good afternoon if it will not for anything in this case but I found this on apps_compressed:
x40BF86FF 'kDHd:! eNULL: @ STRENGTH'
0x40BF8765 'eNULL:! ANULL: @ STRENGTH'
0x40BF8784:'/../ cx / source / Xsupplicant / src / auth_methods / eapfast / eapfast.c '
0x40BF889C:'/../ cx / source / Xsupplicant / src / auth_methods / eapfast / eapfast_key.c '
0x40BFAE8C '/ www.openssl.org / support / faq.html'
0x40BFB506: '23456789ABCDEF '
0x40BFC610 '] VOHyrkd'
0x40BFD099: '56789.: AbcdefABCDEF '
Click to expand...
Click to collapse
Umm, sorry, it's not helping anything in that case. FYI there are literally tenths of thousands such char strings in apps_compressed. Good you're looking tho. ;P
Maybe my goal is not clear enough...
Most of us have NO S8600...
But S8600 has few nice NEW Apps.
You can download without attached handset EVERY App you can find via Kies.
BUT not install if attached handset is not valid...
My goal is to make S8500 valid to install S8600 Apps via Kies.
Solution 1 is wait...
Maybe Samsung will offer these Apps like Tintin before Christmas 2012...
Really realistic...
I think minimum 2-3 months not available for S8500/S8530 to be exclusive for S8600...
Solution...
Move your bu ehm brain.
This mission is NOT impossible.
Best Regards
Sorry for them to lose the time, now I will focus more on the subject.
ferrloz thanks.
Hello, I need help from someone smarter
I have NO.1 G4 smartwatch with MT6261. Link to official firmware en.001phone.cn download-45.html
My way to manual read gif file (or via Mtk_Res_V1.3)
* open in R61S_V2_1_W126_128_DAUL_LANGD_20160520.lis
* select info about file to read
Code:
________CUSTOMER__IMAGES__FTE_SLIM240X240__MAINLCD__WORLDCLOCK__MAP01_GIF 0x103d9910 Data 17425 CustImgGroupSingleDataRes.obj(.constdata)
* start address for ROM is 0x10020000 (info from flashtool after load config file)
* 0x103d9910 - 0x10020000 = 0x003b9910 (address in rom file)
* i don't know why but I add 8 byte to address and limit in length
* in result I have start address 0x003b9918 and length 17417 for GIF file, after export this by hexinator-32-1.9 I can open GIF
when I do above procedure for PNG file i recaive below file (i can't upload file)
Code:
file name: raw_png
0000-0010: f0 00 0f 00-00 00 00 15-5c 00 00 00-ff ff df ff ........ \.......
0000-0020: be f7 9e f7-7d ef 5d ef-3c e7 1c e7-fb de db de ....}.]. <.......
0000-0030: ba d6 9a d6-79 ce 59 ce-38 c6 18 c6-f7 bd d7 bd ....y.Y. 8.......
0000-0040: b6 b5 96 b5-75 ad 55 ad-34 a5 14 a5-f3 9c d3 9c ....u.U. 4.......
0000-0050: b2 94 92 94-71 8c 51 8c-30 84 10 84-ef 7b cf 7b ....q.Q. 0....{.{
0000-0060: af 7b af 73-ae 73 8e 73-6e 6b 6d 6b-4d 6b 2d 6b .{.s.s.s nkmkMk-k
0000-0070: 2d 63 2c 63-0c 63 ec 62-ec 5a eb 5a-cb 5a ab 5a -c,c.c.b .Z.Z.Z.Z
0000-0080: ab 52 aa 52-8a 52 6a 52-6a 4a 69 4a-49 4a 29 4a .R.R.RjR jJiJIJ)J
0000-0090: 29 42 28 42-08 42 e8 41-e8 39 e7 39-c7 39 a7 39 )B(B.B.A .9.9.9.9
0000-00a0: a7 31 a6 31-86 31 66 31-66 29 65 29-45 29 25 29 .1.1.1f1 f)e)E)%)
0000-00b0: 25 21 24 21-04 21 e4 20-e4 18 e3 18-c3 18 a3 18 %!$!.!.. ........
0000-00c0: a3 10 a2 10-82 10 62 10-61 08 41 08-21 08 21 00 ......b. a.A.!.!.
0000-00d0: 20 00 00 00-7f dc 3f ee-1f f7 8f fb-c7 fd e3 1a ......?. ........
0000-00e0: 71 03 3a 7f-dc 36 6e 00-e3 8f db c6-0d 88 fc 71 q.:..6n. .......q
0000-00f0: db b8 01 91-3f 6e 1b 37-20 f2 c7 6d-e3 06 44 fe ....?n.7 ...m..D.
0000-0100: b8 6d dc 80-c8 1f b7 8d-1b 10 f9 e3-b6 71 03 22 .m...... .....q."
0000-0110: 7f dc 36 6e-40 e4 8f db-c6 0d 88 fc-71 db b8 01 [email protected] ....q...
0000-0120: 91 3f 6e 1b-37 20 f2 c7-6d e3 06 44-fe b8 6d dc .?n.7... m..D..m.
0000-0130: 80 c8 1f 77-86 1b c8 8b-de 70 03 22-37 dc c0 28 ...w.... .p."7..(
0000-0140: 2f 8f 1b b8-68 b0 70 03-b7 3c 04 6e-40 04 81 1b /...h.p. .<[email protected]
0000-0150: c8 db b2 70-03 1b 8b 3c-ae 60 2f 50-5b e1 0a 62 ...p...< .`/P[..b
0000-0160: 31 d4 03 6e-40 e4 80 2b-48 c5 60 57-b8 82 b5 40 [email protected]+ H.`[email protected]
0000-0170: 4f 8f 1b 48-21 84 70 03-79 34 04 6e-a0 87 79 c0 O..H!.p. y4.n..y.
0000-0180: 0d 88 1c 70-03 99 1e 04-6e 20 8d 17-c2 0d 24 50 ...p.... n.....$P
0000-0190: f6 b8 82 d5-00 08 84 1b-c8 db 20 70-03 41 c1 03 ........ ...p.A..
0000-01a0: 6e 40 e4 80-1b 18 04 21-70 03 37 3c-10 ae 20 28 [email protected]! p.7<...(
0000-01b0: 50 e5 e3 0a-82 02 d4 0a-2e 40 15 81-2b 48 e5 5c P....... [email protected]+H.\
0000-01c0: 0f b8 81 a5-da 01 37 20-72 c0 0d ac-95 0e b8 82 ......7. r.......
0000-01d0: 57 0e 15 81-0b 50 ad e0-0a 52 03 20-3f 6e e0 80 W....P.. .R..?n..
0000-01e0: 52 c1 0d 44-b5 10 b8 81-1f e2 01 37-10 d5 3a e0 R..D.... ...7..:.
0000-01f0: 06 44 0e b8-81 2d d4 01-37 90 f8 41-e0 06 b6 50 .D...-.. 7..A...P
0000-0200: 15 dc 40 ca-e0 8f 2b 58-0b 14 29 b8-81 c0 0e 02 . [user=457974]@...[/user]+X ..).....
0000-0210: 37 50 d4 3a-e0 06 b2 4c-07 dc 80 c8-01 37 d0 c4 7P.:...L .....7..
0000-0220: 3a e0 06 b6-44 08 dc c0-0e 90 82 2b-58 0c d4 fe :...D... ...+X...
0000-0230: b8 00 dc 40-46 a2 82 1b-a8 41 1e 70-03 6b a1 03 [email protected] .A.p.k..
0000-0240: 6e 20 0e 74-c0 0d 68 1c-70 03 41 b8-03 6e 60 a8 n..t..h. p.A..n`.
0000-0250: 76 c0 0d 44-6a 2a b8 81-09 c6 1f 37-80 2b 98 0c v..Dj*.. ...7.+..
0000-0260: c0 12 b8 81-49 26 02 37-10 94 3a e0-06 22 37 07 ....I&.7 ..:.."7.
0000-0270: dc 40 e0 e7-80 1b b0 39-e0 06 7e 80-07 dc c0 0d [user=3321880]@.....[/user]9 ..~.....
0000-0280: f2 80 1b 98-02 21 70 03-99 c9 04 ae-20 2c 90 fc .....!p. .....,..
0000-0290: e3 0a 70 03-2f 81 04 6e-20 ee 82 c0-0d ec 69 0e ..p./..n ......i.
0000-02a0: b8 82 5b 0b-d4 80 1b 88-8d 46 70 03-a3 58 03 ae ..[..... .Fp..X..
0000-02b0: 20 d4 b2 3d-e0 06 6a 7a-08 dc c0 0b-2e 81 1b 18 ...=..jz ........
0000-02c0: b8 fc 71 07-b8 82 d7 40-27 81 1b 68-09 1e 70 05 [email protected] '..h..p.
0000-02d0: b7 1b e8 01-37 30 96 1c-e1 06 26 63-07 5c 41 e8 ....70.. ..&c.\A.
0000-02e0: 66 7b c0 0d-0c 5a 12 b8-82 9d c0 f5-8f 4b c0 15 f{...Z.. .....K..
0000-02f0: 2c 05 a0 08-dc c0 58 07-81 1b 28 4a-dd 70 03 53 ,.....X. ..(J.p.S
0000-0300: 22 04 6e 60-27 86 c0 15-84 06 4a 7f-5c 03 6e 60 ".n`'... ..J.\.n`
0000-0310: 21 92 c0 0d-c4 30 0f b8-81 41 ce 0d-37 90 13 3c !....0.. .A..7..<
0000-0320: e0 06 32 31-09 dc c0 48-e1 8f 7b c0-15 cc 05 78 ..21...H ..{....x
0000-0330: 08 dc 40 54-08 81 0b c0-d4 e0 06 6c-35 b8 00 4c . [user=1595719]@t...[/user]. ...l5..L
0000-0340: 04 6e 60 08-85 c0 15 e4-05 72 7f 5c-04 6e e0 e3 .n`..... .r.\.n..
0000-0350: 80 c0 15 a4-62 ae 1c dc-c2 ea 35 4a-6d 52 07 98 ....b... ..5JmR..
0000-0360: 85 d4 26 35-7a ad 72 70-05 af 18 2a-02 37 f0 f0 ..&5z.rp ...*.7..
0000-0370: f8 e3 26 70-05 99 01 13-02 37 f0 03-c2 e0 5e 56 ..&p.... .7....^V
0000-0380: b7 49 6a 10-1a 84 16 9b-c8 64 12 d9-2c 42 83 d0 .Ij..... .d..,B..
0000-0390: 20 35 b9 ad-62 70 03 41-1f 04 ae a0-29 c0 fc e3 .5..bp.A ....)...
0000-03a0: 2a 70 05 35-81 eb 01 37-90 c9 b2 e0-6e 56 a1 c9 *p.5...7 ....nV..
0000-03b0: 62 12 99 6c-26 9b 49 66-92 c9 4c 32-93 cd 64 33 b..l&.If ..L2..d3
0000-03c0: 89 4c 16 93-d0 aa 05 37-90 c5 3c e0-0a 5e 03 9a .L.....7 ..<..^..
0000-03d0: 3f ee 02 57-f0 1a c8 74-70 43 af 5b-22 b5 17 05 ?..W...t pC.["...
0000-03e0: 42 8b cd 24-93 89 64 22-93 49 24 13-c9 64 26 9b B..$..d" .I$..d&.
0000-03f0: 45 28 30 da-a3 12 b7 d7-0e ae 60 26-70 fd e3 32 E(0..... ..`&p..2
0000-0400: 70 05 51 81-a6 06 17 12-8b 2d 32 93-4c 24 b3 c8 p.Q..... .-2.L$..
0000-0410: 44 32 93 49-66 31 39 80-84 4c 16 99-c9 24 13 c9 D2.If19. .L...$..
0000-0420: 2c 32 91 cc-24 b3 88 c5-6a 70 05 9b-01 d4 1f 57 ,2..$... jp.....W
0000-0430: 80 1b d8 a2-25 70 03 11-8e 0c 6e 22-95 da ab f2 ....%p.. ..n"....
0000-0440: a8 40 28 b1-39 90 5c 44-22 89 c4 22-12 59 24 12 [email protected](.9.\D "..".Y$.
0000-0450: 91 c8 81 64-62 93 08 05-52 79 d5 1e-95 9a c1 0d ...db... Ry......
0000-0460: 74 20 12 b8-81 b4 d6 1d-57 90 e8 68-22 70 05 7b t....... W..h"p.{
0000-0470: 81 9c 05 77-f5 ba 05 36-91 4c 24 b2-c8 44 32 91 ...w...6 .L$..D2.
0000-0480: 45 64 31 c9-8c 52 a9 d5-2a 95 1a 65-26 8b c8 22 Ed1..R.. *..e&.."
0000-0490: 92 89 64 16-91 48 26 b2-09 dc 5e 2d-b8 82 b9 40 ..d..H&. ..^[email protected]
0000-04a0: 0f 81 2b d8-74 10 f1 b8-81 35 4a 02-37 90 c7 ac ..+.t... .5J.7...
0000-04b0: e0 46 62 a3-3c 6c ae ca-8b 06 a1 44-24 31 09 ad .Fb.<l.. ...D$1..
0000-04c0: 62 b7 09 dc-c8 2d b6 0a-4d 12 91 44-68 30 ca ab b....-.. M..Dh0..
0000-04d0: e6 b0 bc 28-b6 82 1b c8-e4 25 70 03-29 35 3d 6e ...(.... .%p.)5=n
0000-04e0: a0 27 04 c2-65 ec 41 91-c5 26 b1 59-64 16 8b 4c .'..e.A. .&.Yd..L
0000-04f0: ea 04 97 91-ca 2c 16 99-c5 26 b1 59-44 42 7b 20 .....,.. .&.YDB{.
0000-0500: dc c0 90 67-8f 2b 88 a5-f0 3a b8 8c-d8 e0 35 77 ...g.+.. .:....5w
0000-0510: ed 41 89 cd-60 b2 b9 bd-e0 32 6e 9b-c9 60 93 08 .A..`... .2n..`..
0000-0520: ed 5d 73 d7-20 b6 83 2b-c8 a3 60 f9-b8 82 c5 07 .]s....+ ..`.....
0000-0530: 95 81 1b 98-eb 31 70 17-99 d4 62 b0-9a ab f6 a0 .....1p. ..b.....
0000-0540: 3c 68 75 83-bb 58 85 f2-a0 bd 6a ae-1a 2c 52 99 <hu..X.. ..j..,R.
0000-0550: 1b 5c 41 ea-a3 28 c7 05-60 2a 70 05-53 9a ad 02 .\A..(.. `*p.S...
0000-0560: 77 90 13 28-6c 15 b8 8b-55 2a ad 4a-44 36 83 c9 w..(l... U*.JD6..
0000-0570: e0 75 db c1-5d dc 5e 83-c9 60 13 49-ac d2 a8 d5 .u..].^. .`.I....
0000-0580: 0c ae e0 56-93 52 e0 02-30 cf b8 81-21 90 02 37 ...V.R.. 0...!..7
0000-0590: 90 87 55 e0-0e 6e 36 01-8f 02 37 91-58 ac d6 a8 ..U..n6. ..7.X...
0000-05a0: c1 24 11 89-0d e1 26 62-91 c4 64 90-5a ab 16 89 .$....&b ..d.Z...
0000-05b0: 0c dc c1 aa-e3 53 45 e0-06 62 79 0a-dc 40 50 e8 .....SE. [email protected]
0000-05c0: 8c 2b b8 9d-a4 24 b8 81-49 da 00 57-10 14 88 1e .+...$.. I..W....
0000-05d0: 70 15 b7 bc-2a 90 48 a5-41 7b 51 ec-08 57 11 1b p...*.H. A{Q..W..
0000-05e0: ed 41 69 54-22 b0 ca db-2a 70 07 af-9c c0 86 82 .AiT"... *p......
0000-05f0: 2b 98 9a 6c-d1 b8 82 d5-49 0c 82 3b-68 0a 04 a0 +..l.... I..;h...
0000-0600: 03 dc 40 c2-c4 80 ab 78-85 42 73 54-64 10 ca a3 . [user=1941659]@....[/user]x .BsTd...
0000-0610: 62 4b b8 8a-58 2a 0f 1a-44 52 73 50-e8 55 81 2b bK..X*.. DRsP.U.+
0000-0620: c8 0a 04 27-b8 82 b1 49-55 8d 2b d8-84 e4 1e b8 ...'...I U.+.....
0000-0630: 83 21 cd 01-32 c0 15 8c-05 82 05 dc-44 2c 2f 59 .!..2... ....D,/Y
0000-0640: e5 35 93 3d-ea f6 84 9b-b8 a5 f6 92-4d 5e 35 c9 .5.=.... ....M^5.
0000-0650: c3 26 70 05-a9 81 ce 04-57 30 07 69-b2 71 05 91 .&p..... W0.i.q..
0000-0660: 8d 22 04 57-90 17 e0 0d-70 03 19 08-02 6e 62 b5 .".W.... p....nb.
0000-0670: 57 25 f6 a8-41 22 14 9b-c2 4d c4 42-89 41 6a 8f W%..A".. .M.B.Aj.
0000-0680: 58 ed 55 11-b8 81 13 c1-04 57 b0 d8-40 ba 71 05 X.U..... [email protected]
0000-0690: 83 10 24 04-37 d0 61 18-e0 0a 22 03-28 01 6e 22 ..$.7.a. ..".(.n"
0000-06a0: 96 da cc 25-9b bd 64 72-bb c2 4d dc-26 93 bd 66 ...%..dr ..M.&..f
0000-06b0: 32 d7 a4 62-0d b8 82 c4-00 4c 82 2b-88 84 04 e1 2..b.... .L.+....
0000-06c0: b8 81 bc 20-04 57 b0 19-40 0d 70 03-69 45 01 2e .....W.. @.p.iE..
0000-06d0: e2 b6 87 ac-12 83 cd e0-b6 85 8b b8-0d 36 83 c4 ........ .....6..
0000-06e0: 2a b2 b7 35-e0 06 2a 16-13 dc c0 20-8f 8c 1b c8 *..5..*. ........
0000-06f0: 0c 79 70 05-35 81 a8 01-17 11 4b a4-26 79 cd 26 .yp.5... ..K.&y.&
0000-0700: 0f fb c2 45-c4 f2 9a 4d-5e 92 4a c4-12 70 05 41 ...E...M ^.J..p.A
0000-0710: 81 22 08 37-30 c4 bc e2-0e 6e 3f 12-2c 07 57 70 .".70... .n?.,.Wp
0000-0720: 1b b0 18 70-11 b1 4d 1e-b1 59 0c 46-b1 2f 5c 44 ...p..M. .Y.F./\D
0000-0730: 6c 34 58 6c-12 79 4d 2c-01 37 10 16-fa e0 0e 62 l4Xl.yM, .7.....b
0000-0740: 25 9f 6d 16-57 10 35 69-72 70 03 73-3c 03 ee 21 %.m.W.5i rp.s<..!
0000-0750: 31 19 2d 06-99 49 6a 0c-f7 90 9a 64-06 8b d1 24 1.-..Ij. ...d...$
0000-0760: b1 84 2b d8-9c a0 b8 b8-82 2d 08 72-84 7b 48 8d ..+..... .-.r.{H.
0000-0770: 26 81 44 66-91 39 c3 3d-64 16 99 44-60 32 4a 1d &.Df.9.= d..D`2J.
0000-0780: e1 0a 22 21-2d 2f ae 60-ce d1 13 e1-1e 46 7b 45 .."!-/.` .....F{E
0000-0790: 68 92 58 dc-56 70 03 99-b1 81 5a 20-ac 58 c1 3d h.X.Vp.. ..Z..X.=
0000-07a0: dc 16 89 49-68 b1 17 15-e1 0a f6 1c-39 30 ae 20 ...Ih... ....90..
0000-07b0: 11 92 03 e1-22 56 93 d1-24 b1 58 64-6e 2b b8 82 ...."V.. $.Xdn+..
0000-07c0: 44 0f 48 20-14 c8 e1 55-70 11 b7 cc-62 91 98 8c D.H....U p...b...
0000-07d0: 26 ab 20 5c-c1 1c 84 28-c6 0d 6c 02-41 b8 87 db &..\...( ..l.A...
0000-07e0: 22 90 d8 4c-12 ab 12 dc-c2 2d 33 d9-cc 89 06 4c "..L.... .-3....L
0000-07f0: 85 22 5a 33-99 c4 4a 70-0f ab c4 64-93 08 2c 6e ."Z3..Jp ...d..,n
0000-0800: 41 b8 81 c0-e6 1f d7 80-6b 98 44 42-93 c9 62 72 A....... k.DB..br
0000-0810: 82 4b 78 35-85 44 a5 02-13 61 49 24-02 45 27 b8 .Kx5.D.. .aI$.E'.
0000-0820: 86 c9 62 32-09 45 26 f5-b8 81 ad 22-0b d7 90 8a ..b2.E&. ..."....
0000-0830: 2c 16 93 44-e8 04 57 f0-8a 2a 29 98-02 45 d4 09 ,..D..W. .*)..E..
0000-0840: ae 21 94 98-2c 16 91 54-16 6e 60 b1-75 c3 15 e4 .!..,..T .n`.u...
0000-0850: 39 7a 10 5c-41 d8 03 a6-c2 3d ac 06-93 4d 66 12 9z.\A... .=...Mf.
0000-0860: 59 9d e0 0a-5e 53 25 05-53 a0 88 3a-c1 3d ac 22 Y...^S%. S..:.=."
0000-0870: 93 cc 66 32-58 55 e1 0a-c2 1e 30 08-ae 60 cf c1 ..f2XU.. ..0..`..
0000-0880: 1b e1 12 36-1f 81 0a f4-81 3b 98 a4-74 b6 28 5c ...6.... .;..t.(\
0000-0890: 41 2c 94 29-90 0c 2c 62-27 b8 82 d7-54 49 c1 14 A,.)..,b '...TI..
0000-08a0: 28 a2 4e 70-03 b1 45 81-a4 20 13 8a-45 e1 0e 6e (.Np..E. ....E..n
...
0000-23b0: e4 8f db c6-0d 88 fc 71-db b8 01 91-3f 6e 1b 37 .......q ....?n.7
0000-23c0: 20 f2 c7 6d-e3 06 44 fe-b8 6d dc 80-c8 1f b7 8d ...m..D. .m......
0000-23d0: 1b 10 f9 e3-b6 71 03 18-7f dc 36 6e-60 a7 f3 c7 .....q.. ..6n`...
0000-23dc: fd e3 fe 71-ff b8 7f dc-3f ae 11 17 ...q.... ?...
how to read PNG files? or how convert this file to png