Develop Bugs

Bepe's WWE WM6 on Orbit

I've read through the WWE thread and still haven't managed to find people's experiences with this ROM and their UK Orbit's.
Can people please post any issues, and more importantly if I'll brick my Orbit (as from the shop so unsure whether CID locked / unlocked) if I follow the steps in the original thread?
Thanks.

I had no luck. I'm waiting for WM6 ROM from O2 UK to get the phone working again as I can still access the bootloader.

Same for me. Followed all the steps, but still my phone bricked. Mine was CID locked, but because there were several succesful upgrades on CID locked devices I also tried it. I'm also still able to enter bootlloader, so just have to wait for retail WM6 ( have no RUU signed update to restore my device )

I moved from a Orbit with a HTC P3300 Rom (CID Unlocked) to a WM6 Bebe Rom at the first attempt.
It's so much quicker than the WM5 Rom. It's a lot more stable.
If you want me to post the steps and a Apps I've tested I'll do so tomorrow.

I couldn't get Bepe's to load with the boot loader, but the next part with the windows.nb file worked..........
Sort of, I think the bluetooth is not working properly as I can't create a port to allow me to sync with my pc. Apart from that it is working fine. (Touch wood)

doesn't seem worth the risk...
sounds to me like it isn't worth trying at the moment then! shame cause i want to get wm6 running but would rather not have a bricked device ... and the odds look high!
come on o2... where's our official rom?

I've just upgraded my O2 Orbit and it worked fine. CID unlocked it with IMEI-Check and then followed Bepe's instructions.

mmmm... fair enough but i just don't wanna shell out $20 to get a cracked rom...

If I am not mistaken is it not £20 as opposed to dollars I would pay a tenner but like you I will wait for £20

Does anyone know if HTC will require an actual P3300 IMEI in order to download the WM6 update when and if they release it?

itschase said:
Does anyone know if HTC will require an actual P3300 IMEI in order to download the WM6 update when and if they release it?
Click to expand...
Click to collapse
probably, they will require you to give this to prove you have a HTC branded device. TBH they shoudl provide a ROMforAll no matter what provider you have you should be able to upgrade to a clean manufacture rom.

for those who have O2-Orbit UK and can access only bootloader, did U try to flash german WM6? just run file downloaded from german o2 (without any hexedits etc. just run xdaorbit-windows-update.exe). I think it should work, because CID lock is not to lang version, but for operator (02_01) and both UK and DE Orbit are ARTE2000. Worth a try. If it works let it boot to calibration screen plug usb cable and reflash using bepe's ROM. Let us know. I'm not sure if it'll work, I'm CIDunlocked.

phsnake said:
for those who have O2-Orbit UK and can access only bootloader, did U try to flash german WM6? just run file downloaded from german o2 (without any hexedits etc. just run xdaorbit-windows-update.exe). I think it should work, because CID lock is not to lang version, but for operator (02_01) and both UK and DE Orbit are ARTE2000. Worth a try. If it works let it boot to calibration screen plug usb cable and reflash using bepe's ROM. Let us know. I'm not sure if it'll work, I'm CIDunlocked.
Click to expand...
Click to collapse
Do you think the same would apply if you Hex edited ARTE10000 to ARTE2000? Sily question, I know, but is that the only level of security that actually looks for model ID?

in o2 ger image its already ARTE***** so u dont need to change anything (it means it shoul work for arte100,110,1000,200 models maybe 300 as well - htc love) But this is looking only for ModelID, in ROmUpdate Util it checks somehow for ModelVendor/Operator - addr:x0003BA6C - password BsaD5SeoA

I also "BRICKED" my Orbit. I am also the impatient type. Why wait for O2 to release a ROM image? I have spoken with O2 directly. My friend even works for their technical division. As far as I have been able to find out, from friends and his friends at O2, there is NO O2-UK WM6 in the pipeline at the moment. Not enough users apparently. When I found out this I put my Orbit into O2 shop for repair. It was flashed under warranty as a software fault. I have since CID-unlocked it and flashed to WM6.
Absolutely amazing. WM5 to WM6 is night and day. So much faster and a lot nicer looking too.

Shand359 said:
Absolutely amazing. WM5 to WM6 is night and day. So much faster and a lot nicer looking too.
Click to expand...
Click to collapse
My experience: O2 Orbit bought in CZ. My way was: CID unlock -> try-and-brick (...) -> German original O2 WM6 ROM (with bootloader) -> Arte WM6 from bepe.
I am very happy now (extremly stable!) and at this moment I do not plan even upgrade to a new ROM.
Btw solved the issue with localization (keyboard only - Resco works perfectly) and external keyboard support for my beloved iGo Sierra bluetooth keyboard: AE Keyboard mapping SW solved my needs

MY experiences
Being a corporate O2 customer, when I bricked my Orbit they sent me a new one and said I could do what I wanted with the old one.. it's still a brick, having tried every suggestion on this forum!!!
MY new one, however, is running Bepe's WM6, having run the USPL first.
I tried Black&Blue, but found it drained the battery too quickly, and I reall ydon't need all the extras it comes with. I've got Bepe's WM6 running brillianlty - all I add is a cracked version of TomTom 6.02, which runs perfectly, BatteryStatus purely for a power display, no overclocking needed, and TodayAgenda for improved calendar on Today.
I use push mail to connect to my office exchange server, and have all my personal mail ending up at fastmail.net, where I connect to using IMAP - deleting from the phone deletes properly on the IMAP server now, unlike on WM5, so you really can have a synchronised mailbox usin IMAP and a free account at Fastmail.net...
I also have JetwareMobile installed to enable me to use my Siemens HKW600 Car kit (£40 on ebay, superb!), and I have some Sony DR-BT30Q bluetooth headphones which work perfectly...

I have a CID LOCKED UK o2 Orbit. I ran the USPL program by Prof and then Bepe's WWE ROM.
worked fine and WM6 is great!

jamin100 said:
I have a CID LOCKED UK o2 Orbit. I ran the USPL program by Prof and then Bepe's WWE ROM.
worked fine and WM6 is great!
Click to expand...
Click to collapse
Yes, but that doesn't work if you've already bricked your Orbit

Does anyone happen to have a WM5 ROM to restore to if the WM6 goes horribly tits up - I'm not overly looking forward to the idea of not having the pride of the mobile fleet working... the humiliation!

[release] JumpSPL v1.0, or how-to CID unlock ANY device!

JumpSPL is a WinCE application that allows to place a custom file on device's RAM memory and execute the arbitrary code contained on it by jumping into its physical memory address.
This method is tipically used to load a patched bootloader in RAM and execute it, so with JumpSPL you can potentially bypass any bootloader protections put by the manufacturer on a Windows Mobile based device, but you have to patch the bootloader yourself.
I'll be updating comment #2 with links to patched SPLs and future projects using JumpSPL, if you use JumpSPL in your project please post a comment or PM me.
JumpSPL should work on any WinCE device (not necessarily manufactured by HTC), although I have only tested it on HTC devices.
For more details and usage instructions please see the included README file.
DONATIONS:
Your donations are a strong incentive to continue research on new devices, if you find JumpSPL useful please cosider making a PayPal donation. Any donation amount is greatly appreciated ​​

Patched SPLs
Notes on patching & testing custom SPLs:
Disassemble the SPL using radare (free) or IDA Pro (commercial).
You need to press the bootloader buttons after loading your custom SPL with JumpSPL, otherwise device will reboot. You can also patch the SPL to enter bootloader mode automatically, so you don't have to press the buttons.
Some devices require that you unplug and re-plug the USB cable after the SPL has been loaded.
On some devices (TI OMAP) you'll see a white screen instead of the usual tri-color screen, don't worry about that, you're in bootloader mode.
Use patched SPLs with caution, try to flash splash screens to do the initial tests and avoid bricking your device.
To know the jump address you can use itsutils 'pmemdump -p' and try to find a copy of the SPL in memory. You can find the virtual address with dumpromx.exe.
Projects using JumpSPL:
HTC Kaiser SSPL v1 and HardSPL v1
Attached SPL patches:
Kaiser Jump address is 0x00000000
Artemis & Herald Jump address is 0x10000000

Dude. If you can get this to work on the T-Mobile Wing, you will be my own personal hero.

@Mi|enko: Patched SPL for T-Mobile Wing (Herald) attached to comment #2

So ... its possible this way to CID unlock a Prophet G4 ? Can you make a version for prophet?

@kalavera: I don't own a Prophet, but yes should be possible to CID unlock it using this tool. Olipro and the-equinoxe have patched the Wizard's G4 SPL, which should be very close to prophet's, they will be able to help you with the SPL patches.

what patch is compatible to wizard?

Finally I could convert Dopod C800 into a fully working Atlas.Long live POF

Good work Pof!! This could have saved me a bit of time custom compiling my own HaRET for the Titan Hard-SPL. I'm sure it will speed up the unlocking of many future devices!

thanks again my friend!!
you did it again

Good jobs
What its adress to Htc Oxygen? Thanx

How about ATOM PURE, can i use this safely for CID unlock then i can use now sharkindark pagepool changer?

generalriden said:
How about ATOM PURE, can i use this safely for CID unlock then i can use now sharkindark pagepool changer?
Click to expand...
Click to collapse
which I can modify with jumpspl in herald?
os is ok,but how about others?
SPL
IPL
EXTEND_ROM
SPLASH
and modify SPL IPL seems to be quite dangerous...since I bricked herald before.

Geo2000 said:
What its adress to Htc Oxygen? Thanx
Click to expand...
Click to collapse
It's an OMAP device, so I guess the address will be also 0x10000000.
generalriden said:
How about ATOM PURE, can i use this safely for CID unlock then i can use now sharkindark pagepool changer?
Click to expand...
Click to collapse
You need to patch a bootloader first, and find the jump address.
yangchao8115 said:
which I can modify with jumpspl in herald?
Click to expand...
Click to collapse
You can modify any rom part once you can flash unsigned code, but as you say be careful with IPL & SPL. Also try to not screw the OS part if you don't have a ROM matching your CID, otherwise you'll be stuck in bootloader.

Sir i dont know to patch the bootloader and find the jump address..how?

pof said:
You can modify any rom part once you can flash unsigned code, but as you say be careful with IPL & SPL. Also try to not screw the OS part if you don't have a ROM matching your CID, otherwise you'll be stuck in bootloader.
Click to expand...
Click to collapse
yes,but there no tool for herald to edit splash and extend rom.....
and one of my friend bricked with a radio upgraded

Nice job, pof.
fluxist

Hi Pof,
We have a Quanta manufactured device. a.k.a. Atom / Atom Pure / Atom Exec / Atom Life. CID can easily be bypassed in our devices by simply upgrading it in bootloader mode OR do SD CARD flashing. Our problem really pertains to RAPI tools than to upgrade our device with any ROM.
We really don't know if CID is the cause for RAPI tools not to work. The only working tool is to PDOCREAD the device and see its memory layout.
Hope you could shed some light as to how we can patch the bootloader to CID unlock. My knowledge for ARM assembly is very limited...
Thanks,
Jiggs

Okay, I am willing to pay CASH for this if it is what i think it is..
my XDA Terra (Herald) is bricked because I tried to flash it from Touch-It 1.1 to Touch it 2.0. Now, I need the RUU of the XDA Terra which is branded by the provider O2. O2 however does not provide any ROM yet so I am stuck in the united states with a bricked GErman phone I cant even send it in.
Can this jump SPL help me somehow??
please, I will be eternally thankful !!!!

yangchao8115 said:
yes,but there no tool for herald to edit splash and extend rom.....
Click to expand...
Click to collapse
Use the same tools as in Artemis or Elf, splash format is exactly the same, and ExtROM format too, you can edit it with winimage.
fluxist said:
On a (somewhat) related note, would the admins protest if I released a (multi-device) IMEI changing util?
Click to expand...
Click to collapse
I don't think they will protest as long as HTC (or any operator) protests. But make it clear to the end-user to consult local laws before attempting to use your tool, and make sure to put a disclaimer to exempt you of any responsibilities for illegal use of the tool.
jiggs said:
CID can easily be bypassed in our devices by simply upgrading it in bootloader mode OR do SD CARD flashing. Our problem really pertains to RAPI tools than to upgrade our device with any ROM.
We really don't know if CID is the cause for RAPI tools not to work. The only working tool is to PDOCREAD the device and see its memory layout.
Hope you could shed some light as to how we can patch the bootloader to CID unlock. My knowledge for ARM assembly is very limited...
Click to expand...
Click to collapse
Sorry but my knowledge of Atom and Quanta devices is very limited too.
If you want some help, please send me a quanta bootloader and tell me the exact message you get from bootloader (not from RUU) when you try to flash an Atom ROM not intended for your device (ie: not matching your CID, or language...).
exxi said:
Can this jump SPL help me somehow??
Click to expand...
Click to collapse
JumpSPL is a WinCE application, it won't help if you can't boot OS.

Unlock LG KS20 SFR

Hello
I have second LG KS20 from SFR ( french WM6 ) but is locked, and now i want unlock it.
It is solution for this phone via SW or CODE?

Bump.
Still nothing about a SIM unlock for the LG KS20?

Hey guys,
Still no one working on a way to unlock that phone? I'd really like to get one of thoses but my operator is Orange so... As there is WM6 on it, i guess that must be possible right? Even better, if a dev could check the phone to make a new rom with Touchflo perhaps ? ^^ Thank's a lot !

Hello,
i search for an unlock software to LG KS20 on SFR.
When you type 2945#*20# on ks20 you will see a screen to unlock the phone but a code is needed.
This program is WallpaperUnlock.exe in \Windows directory.
Wait for a solution...
If an experts of xda-dev can crack this software we can unlock the phone.
I post the original WallpaperUnlock.exe

Nice find. Let's hope someone can figure out how to crack it
Personally more interested in the CID unlock, though

I found this website http://www.unlock-simlock.dk/unlock/lg/ks20/ on google but don't know what language is it in. I hope this is about unlocking LG ks20

nastycoco said:
I found this website http://www.unlock-simlock.dk/unlock/lg/ks20/ on google but don't know what language is it in. I hope this is about unlocking LG ks20
Click to expand...
Click to collapse
It's in Danish. It says that they will soon be able to unlock it (for money).

Any solution for SIM Unlock yet?
It might be possible to adapt other WM6 unlock tools...

yeah, i am waiting for someone to unlock it also, and i am wondering if the unlock tools in kaiser works on our LG ks20?

I tried to modify the wallpaperunlock.exe
Hello I tried to modify the wallpaperunlock.exe with an hexadecimal editor and a disassembler, but now I don't know how to load it in my rom (Read Only Memory). If I can load it, I think I'm in the good way to unlock this mobile. Can I have some help?!

Hello I'm waiting for an unlocker too.
Seans 972, I think that this soft is in the ROM or extROM so the CID lock must be remove or you must unlock the extROM (Maybe HTC Tools to unlock extROM run with the KS20)

Hello world!
faouzy42 Hello I'm waiting for an unlocker too.
Seans 972, I think that this soft is in the ROM or extROM so the CID lock must be remove or you must unlock the extROM (Maybe HTC Tools to unlock extROM run with the KS20)
________________________________________________________
Hi faouzy42
What's your progress about your cracking session? I found a lot of Important references:
for exemple:
Application Generation --> from offset 000156F9
Wrong unlock --> from offset 00015839
Checking (maybe) password --> from offset 0001588D
Unlock Success --> I don't know but I've an idea
retype Password --> I don't know but I've an idea
I think we may replace the jmp 00015839 by the unlock success procedure line but the syntaxe seems to me be strange.
What software I can use to debug and disassemble this .exe? I'm Using wdasm893 and Hexwork
Can I contact you via messenger? MSN?
We I think we can crack this hellphone.

Hello,
maybe a solution is : change sim in SFR sim (same solution at&t for iphone).
I wait solution to!
Thinks

Hoping you're gonna do it !
Then, I'm still waiting for...

KS20 SFR CID, SIM unlock
hey, i'm using IDA, but i can't seem to connect to the phone directly.
maybe will use a safeboot program
Seans972 said:
faouzy42 Hello I'm waiting for an unlocker too.
Seans 972, I think that this soft is in the ROM or extROM so the CID lock must be remove or you must unlock the extROM (Maybe HTC Tools to unlock extROM run with the KS20)
________________________________________________________
Hi faouzy42
What's your progress about your cracking session? I found a lot of Important references:
for exemple:
Application Generation --> from offset 000156F9
Wrong unlock --> from offset 00015839
Checking (maybe) password --> from offset 0001588D
Unlock Success --> I don't know but I've an idea
retype Password --> I don't know but I've an idea
I think we may replace the jmp 00015839 by the unlock success procedure line but the syntaxe seems to me be strange.
What software I can use to debug and disassemble this .exe? I'm Using wdasm893 and Hexwork
Can I contact you via messenger? MSN?
We I think we can crack this hellphone.
Click to expand...
Click to collapse

Hello,
The LG KS20 or MS25 is same.
The KS20 SFR isn't SIMlocked it is Network locked.
I have instal today my SIM card "leclerc mobile"
All is good.
For the Sim Card you can try "turbo sim" in google.
Tchao

LSk20 sim lock
I put in my rogers sim, and it does NOT work. so i assume it is sim locked.
do these online remote unlocking services work? like
http://discountunlock.com/Unlock/LG/KS20/By/IMEI/Operator/5827/
or http://www.instant-unlock.co.uk/acatalog/KS20.html?
has anyone tried these remote unlocking companies online?
can anyone suggest?
-----------------------------------
i would like to at least have the sim unlocked so i can use the phone, even if it is in french and wait for an english rom
tata2001 said:
Hello,
The LG KS20 or MS25 is same.
The KS20 SFR isn't SIMlocked it is Network locked.
I have instal today my SIM card "leclerc mobile"
All is good.
For the Sim Card you can try "turbo sim" in google.
Tchao
Click to expand...
Click to collapse

You can test this:
1/ Replace the file patched in windows folder (rename master WallpaperUnlock.exe for WallpaperUnlock.back)
2/ Compose on the keyboard phone: 2945#*20#
3/ Then another keyboard appears, to type: 16 Characters and OK
Attention a single test you would risk to block your device about 3 test !

Yes the phone is simlocked (it checks if the sim card is from SFR (at least for the french version) SFR can unlock ir for you though but it will cost arround 70 euros (not cheap at all :/) Also the law in France make the operator/provider to have to provide you the unlock code for free 6 months after purchasing the phone.

Which patched file do you mean? Did anyone test the procedure you described?

Is Cingular 8525 == Hermes?

Hi,
I'm looking into buying Cingular 8525 and unlocking it. I don't see Cingular 8525 written in description for this forum so I'm not sure if it's right place to ask questions.
Here is questions.
1. If I unlock the phone and then download and install official ATT WM6 upgrade, will it relock the phone?
2. Is it ok to use HTC WWE ROM on my phone or it might not work becouse of original branding?

Yes the Cingular/AT&T 8525 is the Hermes.
As for unlocking.. Good luck.. I just got mine 3 weeks ago and discovered that it had already been upgraded to a boot loader that can not be unlocked at this time.
I don't think upgrading the rom to WM6 will re lock the phone.
Not sue on the second part about the WWE rom.

yes it is. I have one.
1. no it won't relock the phone. But read mr vanx guide and wiki before unlock and upgrade. also it is adviced that you install hardspl 2.10 or above.
2. HTC WWE ROM will work only issue might come to you is the keyboard layout which can be fixed if you do little search.

artisticcheese said:
Hi,
I'm looking into buying Cingular 8525 and unlocking it. I don't see Cingular 8525 written in description for this forum so I'm not sure if it's right place to ask questions.
Here is questions.
1. If I unlock the phone and then download and install official ATT WM6 upgrade, will it relock the phone?
2. Is it ok to use HTC WWE ROM on my phone or it might not work becouse of original branding?
Click to expand...
Click to collapse
8525 equals Hermes. Unlocking your device may void any warranty you have. You should only use ROMs made for the Hermes which you will find in this forum.

keitht said:
8525 equals Hermes. Unlocking your device may void any warranty you have. You should only use ROMs made for the Hermes which you will find in this forum.
Click to expand...
Click to collapse
Agree with all of the above comments, with the exception of this one... Loading a non OEM rom, WILL void your warranty... However, many members have been able to successfully reflash with an OEM rom before taking it back to the providers and having any warranty action performed... So, if you need to have your device repaired under the terms of your warranty, you would need to reflash to the OEM version or they will send it back to you unrepaired...
The needed file for fixing the keyboard translation issue is called Cingular Keyboard Fix... a simple google search on this forum should locate it for you... Or you can install another application called "Schaps Advanced Configuration Tool v1.1 (recommended)... In this tool, you can choose your keyboard layout as Cingular...

"Schap's Advanced Configuration Tool" would have been hard to find with a Typo...^^
but please READ MR VANX GUIDE!!! PLEASE!!!

This post will also lead you to all the info you'll need about locking/unlocking, flashing ROM's, etc.
Cheers,

Unlocking HTC TYTN 2

I just recently Purchased a HTC TYTN from Rogers, now i am having problems, how easy it to unlock this phone by hardware was reading about unlocking steps etc. how to do it with the softwares.
Or I bumped into a website http://www.123Unlocking.net unlocking by IMEI i called them they said they give me code and enter it in.
What are plus and negative what way should i go, i dont really want to break my phone, i am not that much of a tech savy guy please give me your input thanks!

Pof way is dead easy mate

what's even easier is calling your service provider, telling them you're going overseas, and asking for the code

Hello,
I would like to unlock my vodafone 1615 and I saw you method to do it. But I read that I need the SPL 1.0 Olipof version. Now in my Kaiser I have the SPL 3.28. I would like to know if I can unlock my kaiser with this SPL version or I need to install before the SPL 1.0 Olipof version. Thank you in advance.

seridem said:
Hello,
I would like to unlock my vodafone 1615 and I saw you method to do it. But I read that I need the SPL 1.0 Olipof version. Now in my Kaiser I have the SPL 3.28. I would like to know if I can unlock my kaiser with this SPL version or I need to install before the SPL 1.0 Olipof version. Thank you in advance.
Click to expand...
Click to collapse
SPL 1.0 Olipof is a version of hard spl, you flash that to your device before doing the sim unlock.
Use the unlocker in this thread, by memory it does the whole lot, hard spl, and sim unlock.
http://forum.xda-developers.com/showthread.php?t=375583
once you have done the unlock, i would then upgrade the radio rom to one of the recent ones, then update hard spl to a recent one, then update the rom to a wm6.1 rom. You need to start reading through the kaiser forum and wiki both of you.
Use that link for the sim unlock though, definately the easiest, i did it the other day on my replacement phone.