Develop Bugs

KernelIoControl 0x010125E0 = HAL Function 0x978 (2424)

Does anybody know the interpretation of KernelIoControl with dwIoControlCode = 0x010125E0? The breakdown of the Control Code is:
DeviceType = 0x0101 = FILE_DEVICE_HAL
Access = 0 = ANY_ACCESS
Function = 0x978 = 2424 dec = ?
Method = 0 = BUFFERED
So what is function 0x978 (2424)?
I searched through the WinCE Platform Builder 5.00 files and did not see any definition of 0x978 nor 2424.
thx,
((&->

Registry help

Can anyone tell me the default value of:
HKLM\Comm\Cellular\Wap\Driver
tnx

jsp_m said:
Can anyone tell me the default value of:
HKLM\Comm\Cellular\Wap\Driver
tnx
Click to expand...
Click to collapse
"(Default)" = "(value not set)"
"Dll" = "WAPdrv.dll"
"Flags" = "0x2 (2)"
"Index" = "0x1 (1)"
"Prefix" = "WAP"

DSM file structure uderstanding

Please sorry me if it is wrong place for my post and please move it to correct place.
Hi guys. I'm trying to discover dsm files structure and I've got some troubles. So i need an advance and hope to find somebody who can wll help me with it.
As i uderstand dsm header look like this:
typedef struct _DeviceManifestHeader
{
const DWORD dwStructSize; // Size of this structure header
const DWORD dwUnknown1; // Unknown for me
const DWORD dwUnknown2; // Unknown for me
const DWORD dwUnknown3; // Unknown for me
const DWORD dwUnknown4; // Unknown for me
const DWORD dwNameLength; // length of filename in bytes.
const DWORD dwNameOffset; // offset to name of package
const DWORD dwUncnown5Count; // Count of unknown entries.
const DWORD dwUncnown5Offset; // Offset to uncnown entries.
const DWORD dwShadowCount; // possible dependent GUID list?.
const DWORD dwShadowOffset; //offset to dependent GUIDs.
const DWORD dwFileCount; // How many files in this manifest.
const DWORD dwFileListOffset; // Offset to the first FileEntry.
const DWORD cbCERTData; // Possible certificate data?
const DWORD dwCERTDataOffset; // offset to the certificate data.
const GUID guidPackage; // GUID of this package same as file name
const GUID2 guidPackage; // possible another guid?
}DeviceManifestHeader, *PDeviceManifestHeader;
typedef struct _FileEntry {
const DWORD dwNameLength;
const DWORD dwFlags;
const DWORD dwOffset;
const DWORD dwBase;
cons DWORD FileSize;
}FILEENTRY,*PFILEENTRY;
So it will be great if somebody will help me with my unknows and manly provide any information about Certificate structure.
Thanks in advance and sorry for my english.

According to my analysis :
TDSMHeader = record
dwStructSize : LongInt; // Size of this structure (in bytes) for versioning
Unknown_1 : LongInt; // 02 00 00 00
Unknown_2 : LongInt; // C2 01 00 00
Unknown_3 : LongInt; // F5 01 00 00
Unknown_4 : LongInt; // 00 00 00 00
dwNameLength : LongInt; // length of filename in bytes.
dwNameOffset : LongInt; // offset to Friendly name of package
dwDependentCount : LongInt; // How many entries in Dependent GUID list.
dwDependentOffset : LongInt; // How many bytes from the front of the file are the dependent GUID structs.
dwShadowCount : LongInt; // How many entries in shadow GUID list.
dwShadowOffset : LongInt; // How many bytes from front of file is the array of shadowed package GUIDs.
dwFileCount : LongInt; // How many files are there listed in this manifest.
dwFileListOffset : LongInt; // How many bytes from the front of file to the first FileEntry.
dwCERTDataLength : LongInt; // number of bytes of digital certificate data
dwCERTDataOffset : LongInt; // How many bytes from the front of file to the certificate data.
Unknown_5 : LongInt; // 05 00 01 00
Unknown_6 : LongInt; // D0 07 FF 39
Unknown_7 : LongInt; // 00 00 00 00
Unknown_8 : LongInt; // 00 00 00 00
Unknown_9 : LongInt; // 05 00 01 00
Unknown_A : LongInt; // D0 07 FF 39
guidPackage1 : TGUID; // GUID of this package}
guidPackage2 : TGUID; // Second GUID ?}
end;
TFileEntry = record
dwNameLength : LongInt;
dwFlags : LongInt;
dwNameOffset : LongInt;
FEUnknown : LongInt;
dwFileSize : LongInt;
end;
TDependentEntry = record
size : LongInt;
version : LongInt;
DEUnknown : LongInt;
guid : TGUID;
end;
I'm developed tool named DSMBuilder (http://forum.xda-developers.com/showthread.php?t=412272) that read and write DSM files and changed this attributes, certificates and rebuild file list.
dwStructSize is currently filled with the value 0x74 (116) and the structures of DSMHeader currently available on the Internet is not of this size
I'm a pascal developer's. In the future, I try to express as a C/C++ programmer.

thank you for your answer.
anmendes said:
According to my analysis :
dwCERTDataLength : LongInt; // number of bytes of digital certificate data
dwCERTDataOffset : LongInt; // How many bytes from the front of file to the certificate data.
Click to expand...
Click to collapse
As i understand CERTData that start from CERTDataOffset and contain CERTDataLength bytes is some kind of structure like dsmheader but i don't know it's format.
i mean:
CERTData = record
SomeThing : SomeType;
e.t.c.
end;
So while you developing DSMBuilder maybe you discover format of this CERTData structure if you did can you share it?

I've done a couple of tools (dsmbuild and dsminfo) which hopefully will be of some help for you:
http://code.google.com/p/htc-flasher/source/browse/#svn/trunk/RomKitchen
Files: dsm.h, dsminfo.c, dsmbuild.c

pof said:
I've done a couple of tools (dsmbuild and dsminfo) which hopefully will be of some help for you:
http://code.google.com/p/htc-flasher/source/browse/#svn/trunk/RomKitchen
Files: dsm.h, dsminfo.c, dsmbuild.c
Click to expand...
Click to collapse
thanks!
I will read very carefully their sources and update my tool, so you're done, put the sources here.
My mind and fully understand the structure of the file from DSM and also build new tools to manipulate roms or just for fun and curiosity.

ksandr said:
thank you for your answer.
As i understand CERTData that start from CERTDataOffset and contain CERTDataLength bytes is some kind of structure like dsmheader but i don't know it's format.
i mean:
CERTData = record
SomeThing : SomeType;
e.t.c.
end;
So while you developing DSMBuilder maybe you discover format of this CERTData structure if you did can you share it?
Click to expand...
Click to collapse
I do not know the structure of the certificates, but Windows Xp can read the files, then I believe that is the standard format for certificates (*. CER)

anmendes said:
I believe that is the standard format for certificates (*. CER)
Click to expand...
Click to collapse
Yes, the certificates use "cer" format.

Very thanks guys for your answers it's really helps me!
will study cer file format.
here one more question: in dsmheader there are two guids one same as file name and what is the other guid?

ksandr said:
Very thanks guys for your answers it's really helps me!
will study cer file format.
here one more question: in dsmheader there are two guids one same as file name and what is the other guid?
Click to expand...
Click to collapse
new version of my DMHeader structure. Second GUID not exists (not matches another GUID in dump folder, then as unknown bytes)
TPkgVersion = record
dwNumber1 : Word;
dwNumber2 : Word;
dwNumber4 : Word;
dwNumber3 : Word;
end;
TDSMHeader = record
dwStructSize : LongInt; // Size of this structure (in bytes) for versioning
dwPackageFlags : LongInt; // Package specific identifiers.
dwProcessorID : LongInt; // what processor (matches defines in winnt.h)
dwOSVersion : LongInt; // what version of the operating system was this built to.
dwPlatformID : LongInt; // what was the target platform.
dwNameLength : LongInt; // length of filename in bytes.
dwNameOffset : LongInt; // offset to Friendly name of package
dwDependentCount : LongInt; // How many entries in Dependent GUID list.
dwDependentOffset : LongInt; // How many bytes from the front of the file are the dependent GUID structs.
dwShadowCount : LongInt; // How many entries in shadow GUID list.
dwShadowOffset : LongInt; // How many bytes from front of file is the array of shadowed package GUIDs.
dwFileCount : LongInt; // How many files are there listed in this manifest.
dwFileListOffset : LongInt; // How many bytes from the front of file to the first FileEntry.
dwCERTDataLength : LongInt; // number of bytes of digital certificate data
dwCERTDataOffset : LongInt; // How many bytes from the front of file to the certificate data.
dwPackageVersion, // Version of this package
dwPrevPkgVersion, // Version of package that this package updates. (0) for Canonical
dwPkgVersion : TPkgVersion; // Version of ... ?!?
guidPackage1 : TGUID; // GUID of this package}
Unknown_1 :LongInt; // Unknown values
Unknown_2 :LongInt; // Unknown values
Unknown_3 :LongInt; // Unknown values
Unknown_4 :LongInt; // Unknown values
end;
TDependentEntry = record
DEUnknown : LongInt; // In my analisys 0 value in all cases
version : TPkgVersion;
guid : TGUID;
end;
dwShadowCount & dwShadowOffSet = Array of GUIDs
dwDependentCount & dwDependentOffSet = Array of TDependentEntry;
Size of DSM file is
sizeof(TDSMHeader) +
sizeof(TDependentEntry) * dwDependentCount
sizeof(TGUID) * dwShadowCount +
FCertificate.Size +
1 + // In DSM exists one byte with value 0 after Certificate ???
length(edFNP.Text) * 2 +
SumFileNameLengths * 2

How to load about dsm in textbox - vb

and sow my friend??

??? Have a Ideas

Possibility to execute download mode programmatically on Omnia 7?

Us T-Mobile users cannot flash Roms at the minute because the download mode button combo has been disabled.
Maybe there is a way to do this programatically or use a resistor accross certain USB pins like the Galaxy S method.
What's your opinion on this?
Sent from my OMNIA7 using Board Express

Yesterday I wasted some time playing around with the USB diagnostic port (enable in the Diagnosis app, it's the third USB mode option). Both PSAS and QPST can connect to and mess with the phone, so I think if someone knows his way around, the phone can be kicked into Download Mode.
(I only managed to crash the phone in many different ways, but I was really just monkeying around.)

If this can be done it would be great as this is the first phone I have owned where I cannot flash firmware myself.
Might be worth while seeing if everyone with a tmobile uk branded omnia 7 has this issue?
FYI I have included my firmware versions etc so we can try and collate a list of working/non working ones to see what the differences are if any.
os version 7.0.7004.0
firmware revision number 2424.10.10.6
hardware revision number 3.15.0.4
radio software version 2424.10.10.6
radio hardware version 0.0.0.800
bootloader version 4.10.1.9
chip soc version 0.36.2.0

KarmaXXK said:
Yesterday I wasted some time playing around with the USB diagnostic port (enable in the Diagnosis app, it's the third USB mode option). Both PSAS and QPST can connect to and mess with the phone, so I think if someone knows his way around, the phone can be kicked into Download Mode.
(I only managed to crash the phone in many different ways, but I was really just monkeying around.)
Click to expand...
Click to collapse
Yes, I tried the *#7284# code and changed the USB Path Control to "Modem, USB Diag" and my phone was recognised by the ROM Downloader but the phone was not in download mode.
I have stumbled upon something which may be what we are looking for though, after reverse engineering the Samsung Diagnosis app I notice there are codes to access 'Operator Specific' Admin areas in the app. Take a look at the attached image.
Now as you can see, the values listed cannot be typed into the Diagnosis app as there is a formula to decipher them. I have the formula but cannot get it to work.
Code:
Private Overloads Function GetHashCode(ByVal str As String) As UInteger
Dim num As UInteger = 0
For i As Integer = 0 To str.Length - 1
[B]num = ((num << 5) + num) + str(i)[/B]
Next
Return num
End Function
Now the bit highlighted in bold is the bit I cant get to work.
It gives the following error:
Operator '+' is not defined for types 'UInteger' and 'Char'.
Once someone can help to get this working, reversing the formula should in theory show us the correct *#000# code combination for each area.

Fingers crossed you can crack it!

lyriquidperfection said:
Yes, I tried the *#7284# code and changed the USB Path Control to "Modem, USB Diag" and my phone was recognised by the ROM Downloader but the phone was not in download mode.
I have stumbled upon something which may be what we are looking for though, after reverse engineering the Samsung Diagnosis app I notice there are codes to access 'Operator Specific' Admin areas in the app. Take a look at the attached image.
Now as you can see, the values listed cannot be typed into the Diagnosis app as there is a formula to decipher them. I have the formula but cannot get it to work.
Code:
Private Overloads Function GetHashCode(ByVal str As String) As UInteger
Dim num As UInteger = 0
For i As Integer = 0 To str.Length - 1
[B]num = ((num << 5) + num) + str(i)[/B]
Next
Return num
End Function
Now the bit highlighted in bold is the bit I cant get to work.
It gives the following error:
Operator '+' is not defined for types 'UInteger' and 'Char'.
Once someone can help to get this working, reversing the formula should in theory show us the correct *#000# code combination for each area.
Click to expand...
Click to collapse
I worked on this few days ago, I couldn't reverse the hash function but we had some brilliant ideas how to do it (see the stackoverflow thread about it http://stackoverflow.com/questions/4523553/reversing-a-hash-function)
but I used brute force and extracted some 60 diagnosis codes that you can find here http://www.martani.net/2010/12/windows-7-hacks-all-diagnosis-codes-you.html
and here http://www.martani.net/2010/12/windows-7-hacks-all-diagnosis-codes-you_26.html

This is great stuff martani if there is any way to decipher these ones, they may be worth looking at:
g_ADMIN_GENERIC = 3370684588
g_ADMIN_TMOBILE = 469486183
g_ADMIN_VODAFONE = 474092301
These ones indeed look very interesting and may offer a way to enable ADC or even the Download Mode some people like me have been looking for.

lyriquidperfection said:
This is great stuff martani if there is any way to decipher these ones, they may be worth looking at:
g_ADMIN_GENERIC = 3370684588
g_ADMIN_TMOBILE = 469486183
g_ADMIN_VODAFONE = 474092301
These ones indeed look very interesting and may offer a way to enable ADC or even the Download Mode some people like me have been looking for.
Click to expand...
Click to collapse
Actually the code is a little misleading, if you see closely, the enum HashCodeTable is used nowhere.
The app waits for user input, after each "tap" on a number it calls the function ParseDial() that hashes the input with GetHashCode then calls the function GetEnumFromList() on this hashed value.
In GetEnumFromList, there is no use of HashCodeTable and even the codes you provided are not hard-coded in this function. I am not sure why they are there but as far as I can tell, to access these parts of the diagnosis app, you need another method than dialing a code it seems

martani said:
Actually the code is a little misleading, if you see closely, the enum HashCodeTable is used nowhere.
The app waits for user input, after each "tap" on a number it calls the function ParseDial() that hashes the input with GetHashCode then calls the function GetEnumFromList() on this hashed value.
In GetEnumFromList, there is no use of HashCodeTable and even the codes you provided are not hard-coded in this function. I am not sure why they are there but as far as I can tell, to access these parts of the diagnosis app, you need another method than dialing a code it seems
Click to expand...
Click to collapse
Damn it! Looks like we are back to square one!
Have you seen also on the Samsung Galaxy S the Download mode is disabled on some devices, but some users made a jig where you bridge 2 pins with a certain resistor and it knocks the phone into download mode. Maybe this would work on the Omnia 7 also????

I am hoping for a software based fix rather than hacking together something.

**ALL** diagnostic codes for SAMSUNG devices
I reverse engineered the Diagnostic Menu Application. It contains a list of configuration "Titles" with corresponding hash-codes. I made a tool to reverse the hash-codes to dial-codes. The dial-codes may not be the same as some codes that were already known, but the dial-codes are absolutely correct for these menu. Differences are due to hash-collisions (same hash-code may have multiple possible dial-codes). I just used the shortest dial-codes for every menu.
The list of menu's is very long and I discovered that not all menu-codes were not actually implemented. I guess this list of codes is used for all Samsung devices (possibly also for Galaxy S and older Windows Mobile devices). So not all dial-codes may actually work on your device.
WARNING!! The menu's can configure low-level settings of your phone. And if you don't know what you're doing you may brick your device or maybe hard-reset the device and loose all your data and settings. Or you may faulty calibrate your sensors. Be very, very careful with experimenting!! I will not take any responsibility for damaging your device in any way.
I would personally be very interested if anyone finds a way to get the device in download-mode by using these menu's (I have a bad bootloader which does not let my Samsung Omnia 7 go into download-mode to flash it to a newer firmware).
By the way: the admin menu's are NOT implemented on the Omnia 7 :-(
This is the list with menu-titles, dial-codes and their hashcode:
Code:
FTAMain = 15 (0x686)
QUALCOMM TEST = *09# (0x17DB96)
TMOServiceMenu = *74*# (0x31710C2)
SMDINFO = *#03# (0x30C0953)
SIMPLE FUNCTION TEST = *#05# (0x30C0995)
IMEI NUMBER = *#06# (0x30C09B6)
VIEWHISTORYNW = *#07# (0x30C09D7)
LCDTEST = *#0*# (0x30C082A)
QWERTYTEST = *#1*# (0x30C0C6B)
BATT TEST = *#2*# (0x30C10AC)
BRIGHTNESS TEST = *#3*# (0x30C14ED)
TouchDelta 80 = *#80# (0x30C2AF8)
LIGHTTEST = *#12*# (0x648DBCDD)
BTLOGDUMP = *#232# (0x648E4E87)
WIFI FACTORY TEST = *#526# (0x648FEFED)
RILNETLOG = *#638# (0x649080D1)
RILDUMP = *#745# (0x64911110)
VPHONE770 = *#770# (0x64911D2E)
VPHONE771 = *#771# (0x64911D4F)
VPHONE772 = *#772# (0x64911D70)
VPHONE773 = *#773# (0x64911D91)
VPHONE774 = *#774# (0x64911DB2)
VPHONE775 = *#775# (0x64911DD3)
VPHONE776 = *#776# (0x64911DF4)
VPHONE777 = *#777# (0x64911E15)
VPHONE778 = *#778# (0x64911E36)
VPHONE779 = *#779# (0x64911E57)
SR TEST = *#780# (0x6491216F)
VT DUMP = *#938# (0x649225F4)
Disable Testbed = #12358# (0xFC28BE89)
Enable Testbed = *12358# (0x170067D0)
DEBUGMODE1 = *#0011# (0xF63246F2)
BATTERYINFO = *#0228# (0xF63364DC)
PHONELOOPBACKTEST = *#0283# (0xF6337DBD)
AUDIOTEST2 = *#0289# (0xF6337E83)
FMRADIORX = *#0368# (0xF6340241)
LIGHTSENSORTEST = *#0589# (0xF63523A6)
RRCVERSION = *#0599# (0xF63527E7)
AUDIOTEST = *#0673# (0xF635AB00)
SOUNDTEST = *#0675# (0xF635AB42)
RTC = *#0782# (0xF6363B81)
DEVICETEST = *#0842# (0xF636B6DE)
ILLUMINATIONTEST = *#0843# (0xF636B6FF)
MultiTouch = *#0987# (0xF63754E8)
SWversionFTA = *#1111# (0xF644EBD4)
MOUSETEST = *#121*# (0xF645774E)
SWversionEx = *#1234# (0xF645811A)
MOUSECAL = *#123*# (0xF6457FD0)
MOUSECAL06 = *#126*# (0xF6458C93)
GPSTEST = *#1575# (0xF6473762)
MICROUSB TEST = *#1793# (0xF6485864)
HWversionFTA = *#2222# (0xF6579518)
BANDSELECTION = *#2263# (0xF657A63D)
PHONEDUMP = *#2454# (0xF658BADF)
CAMERAUPDATE = *#2470# (0xF658C2DD)
CAMERADISABLE = *#2480# (0xF658C71E)
NAVIKEY TEST = *#2486# (0xF658C7E4)
INTEGRITY = *#2580# (0xF659537F)
TouchFirmare 2663 = *#2663# (0xF659D7C1)
TouchDelta 2664 = *#2664# (0xF659D7E2)
TouchDelta 2665 = *#2665# (0xF659D803)
RILNETLOG OFF = *#6380# (0xF6A09CC1)
RILNETLOG ON = *#6381# (0xF6A09CE2)
NETLOCK NETWORK = *#6955# (0xF6A3DAE9)
USBPATHCHANGE = *#7284# (0xF6B22965)
POWERONATTACH = *#7298# (0xF6B22E2A)
SELF DIAGNOSTIC MODE = *#7353# (0xF6B2A8E2)
DebugOption = *#7450# (0xF6B334E0)
ERROR REPORT ON = *#7451# (0xF6B33501)
ERROR REPORT VERIFY = *#7452# (0xF6B33522)
NETLOCK SERVICE = *#7755# (0xF6B4DAA8)
VPHONE DISABLED = *#77*0# (0xF6B4AB38)
VPHONE ENABLED = *#77*1# (0xF6B4AB59)
UARTCHANGER = *#9090# (0xF6D54562)
DEBUGDUMP = *#9900# (0xF6DA0E82)
PILEDUMP = *#9901# (0xF6DA0EA3)
NETLOG LOG START = *#9905# (0xF6DA0F27)
DEBUG RIL DUMP = *#9906# (0xF6DA0F48)
ERRORREPCAB INSTALL = *#9907# (0xF6DA0F69)
GUMITEST3G CAB INSTALL = *#9908# (0xF6DA0F8A)
SUWON3G CAB INSTALL = *#9909# (0xF6DA0FAB)
UARTPATH = *#9910# (0xF6DA12C3)
BATTERYMONITOR = *#9911# (0xF6DA12E4)
CONNECTION SETTING = *#9920# (0xF6DA1704)
VERIFYCOMPARE = *#9990# (0xF6DA34CB)
YSSHINTEST = *#9999# (0xF6DA35F4)
VersionScript = 19104#2* (0xD21FC43E)
BLUETOOTH LOG DISABLE = 20652609 (0x1598F3DE)
BLUETOOTH LOG ENABLE = 20652619 (0x1598F3FF)
BT SSPDEbugModeEnable = 20652629 (0x1598F420)
BT SSPDEbugModeDisable = 20652639 (0x1598F441)
OMADMCLIENT LOG DISABLE = 20653609 (0x1599803F)
OMADMCLIENT LOG ENABLE = 20653619 (0x15998060)
CELOG LOG DISABLE = 20654609 (0x159A0CA0)
CELOG LOG ENABLE = 20654619 (0x159A0CC1)
TOTALCALLTIME = 2934331* (0xC35403F3)
RESET CUSTOM = 35180948 (0x77496B66)
RESET FACTORY = 35190718 (0x775B7B02)
ERASE IMEIITEM = 35190728 (0x775B7B23)
IMEI ADJUST = 35190738 (0x775B7B44)
BLUETOOTH RF TEST = 3##65*88 (0xECE73A9E)
BLUETOOTH AUDIO TEST = 3##65*98 (0xECE73ABF)
AutoSimSetting = 40*047#3 (0xD1C556DF)
PVKKey = 40*549#3 (0xD21FD9E6)
RESET FACTORY WITHDEFAULTLANGUAGE = 76264513 (0x777E1362)
NONSLEEPCALL OFF = *#069*0# (0xBCEBFF49)
NONSLEEPCALL ON = *#069*1# (0xBCEBFF6A)
LEDTEST = *#14789# (0xBF1C1ADD)
DMSessionInit = *#15428# (0xBF2C7494)
CIPHERING = *#32489# (0xC3A095FA)
CAMERAUPDATESVC = *#32589# (0xC3A1225B)
LOGDUMPMGR = *#33284# (0xC3B19514)
SR DISABLED = *#780*0# (0xCD5F5D49)
SR ENABLED = *#780*1# (0xCD5F5D6A)
NETLOCK SUBSET = *#78255# (0xCD60A57B)
LAUNCH UAEDIT = *#92782# (0xD1A12DFC)
PdaBuildTime = *#99820# (0xD2204C1C)
VersionTime = *#99821# (0xD2204C3D)
WIFI TEST = 0373385#6 (0xECE73BA6)
EN LOCK NW = 074578132 (0xBBF27D35)
GCFTESTMODE ENTER = 086#58023 (0x1807BAE3)
FILE SYSTEM TEST = 089559715 (0x28F3F681)
AUDIOGAINCONTROL = 08#766104 (0x902D68E3)
DIS LOCK SUB NW = 17#991#3* (0x1D45A6AE)
PVKFileName = 18*357#25 (0x161B193C)
EN LOCK SUB NW = 193582504 (0xBC073A15)
GPSTESTTOOL = 1#8865#55 (0xF61EC09C)
EN LOCK CORP = 1*0273411 (0xF62C007D)
EN LOCK SVC = 1*0278411 (0xF62EBE62)
DIS LOCK NW = 20789802* (0x1D30E9CE)
SellOutSMS = 2615#0922 (0xD04CA8DE)
TFlashUnPairing = 30334*733 (0x51B892C4)
DIS LOCK SVC = 38025*93# (0xCA957BDB)
GPSTESTTOOL2 = 400#40*08 (0xB9F6D60D)
GPSTESTXTRA = 400#40*18 (0xB9F6D62E)
SerialNumber = 5317*0648 (0x6E256D8C)
EN LOCK SIM = 5494585*3 (0xBC051995)
SERVERURL = 553378683 (0xD8389060)
SLIDECOUNT = 584644021 (0xF0BF3052)
SellOutSMSTestMode = 597#*224# (0x96E7B26D)
APPSLAUNCHER = 5**6244*3 (0x33B0B76)
SLOGSERIAL M2 = 66#6757#1 (0x7050E07C)
AutoReceive Enable = 7160*5088 (0xEF2C5E0D)
TESTMODE = 718071#49 (0x8A09ACC8)
RESET SERVICE = 72673#00# (0xEC5B4BEF)
ReactivateSellOutSMS = 74201#086 (0x807DB65F)
AUDIOCODEC = 7#16#1#37 (0x902D68C2)
ADMIN GENERIC = 838*5448* (0xC8E890AC)
SLOGSERIAL ALL ON = 8644*3081 (0x705107AC)
VT MANUALSETTING = 8802*7*5# (0x104384B5)
DISLOCK SIM = 98217*243 (0x1D43862E)
DMTESTMENU = 9#7357764 (0x414D9633)
SLOGSERIAL ALL OFF = #22#6214# (0x7050E03A)
SLOGSERIAL M1 = #22#6215# (0x7050E05B)
SLOGSERIAL M3 = #22#6217# (0x7050E09D)
SLOGSERIAL M4 = #22#6218# (0x7050E0BE)
SLOGSERIAL M5 = #22#6219# (0x7050E0DF)
ADMIN VODAFONE = #75471648 (0x1C42130D)
DisableSellOutSMS = *4587*676 (0x903477AF)
BLUETOOTH SEARCH TEST = *#232333# (0xECE73AE0)
RANDOM BT MAC = *#232336# (0xECE73B43)
BLUETOOTH MAC VIEWER = *#232337# (0xECE73B64)
WIFI MAC VIEWER = *#232338# (0xECE73B85)
PRECONFIGURATION = *#638738# (0x213EF313)
SELF DIAGNOSTIC MODE DISABLE = *#7353*0# (0x6E008D7C)
SLOGSERIAL M6 = *#745*06# (0x7050E100)
DIS LOCK CORP = 00*2*2#524 (0xCA92BDF6)
ADMIN TMOBILE = 0612824763 (0x1BFBCA67)
AutoReceive Disable = 09925572#3 (0xD4B8217D)
SWversionIn = 1309653522 (0xECB23FC4)
GPSTTFFTESTTOOL = 154*068271 (0xF61EBC7C)
SellOutSMSProductionMode = 1#3341#5#0 (0x96D7C68A)
LOCK STATUS INFO = 28##**23*0 (0x7D8C72E3)
SWversionNewIn = 32456464#7 (0xFD58D7FC)

Heathcliff74 said:
I reverse engineered the Diagnostic Menu Application. It contains a list of configuration "Titles" with corresponding hash-codes. I made a tool to reverse the hash-codes to dial-codes. The dial-codes may not be the same as some codes that were already known, but the dial-codes are absolutely correct for these menu. Differences are due to hash-collisions (same hash-code may have multiple possible dial-codes). I just used the shortest dial-codes for every menu.
Click to expand...
Click to collapse
Can you share how did you reverse the hash function? I worked on this some time ago but finally just brute forced it to extract the keys.

I would also like to know how he reversed the hash codes! I tried for hours and had no luck!

Haha.. Well, I first tried to calculate the original dial-codes, but that seems to work only for dialcodes shorter than 8 digits (5 bits per digit, 32 bits hash-code = 32 / 5 = 7 digits + 1 digit for the extra add):
Code:
uint hash = 0; // enter hash here
string DialCode = "";
while (hash > 0)
{
uint digit = (hash % 33) + 33;
if (digit > hash)
hash = 0;
else
hash = (hash - digit) / 33;
DialCode = Convert.ToChar(digit) + DialCode;
}
return DialCode;
But this does not work for long dial-codes. So after that I just made a little program to brute-force it. I copied the enum with menu-titles and hash-codes to my project. Then I used reflection to populate a sortedlist. Then I started to brute-force and check all dialcodes for their hashcode and see if it exists in the list. If it exists, I add it to a textbox and remove the item from the list. That's it. So it is not really reversed, but my program took about an hour to get dial-codes for all the hashcodes in the enum.
Code:
SortedList<uint, string> hashCodes = new SortedList<uint, string>();
int l = typeof(HashCodeTable).GetEnumNames().Length;
string[] menunames = typeof(HashCodeTable).GetEnumNames();
for (int i = 0; i < l; i++)
{
try
{
hashCodes.Add(Convert.ToUInt32(Enum.Parse(typeof(HashCodeTable), menunames[i])), menunames[i].Substring(2).Replace('_', ' '));
}
catch { }
}
char[] chars = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '#', '*' };
for (int length = 1; length <= 20; length++)
{
ushort[] digits = new ushort[length];
for (int i = 0; i < length; i++) digits[i] = 0;
while (true)
{
// calc hash
uint hashCode = 0;
for (int i = 0; i < length; i++)
{
hashCode = ((hashCode << 5) + hashCode) + chars[digits[i]];
}
if (hashCodes.ContainsKey(hashCode))
{
int m = hashCodes.IndexOfKey(hashCode);
string str = "";
for (int j = 0; j < length; j++)
str = str + chars[digits[j]];
textBox1.Text = textBox1.Text + hashCodes.Values[m] + " = " + str + " (0x" + hashCode.ToString("X") + ")" + Environment.NewLine;
hashCodes.RemoveAt(m);
}
// increase
digits[length - 1]++;
for (int k = length - 1; k >= 0; k--)
{
if (digits[k] >= 12)
{
if (k == 0)
break;
else
{
digits[k] -= 12;
digits[k - 1]++;
}
}
}
if ((digits[0] >= 12) || (hashCodes.Count == 0)) break;
}
if (hashCodes.Count == 0) break;
}

Excellent stuff! Thank you for this very interesting code snippit!

WP7 diag codes
martani said:
Actually the code is a little misleading, if you see closely, the enum HashCodeTable is used nowhere.
Click to expand...
Click to collapse
This is because the compiler optimized out the switch statement and compiled the constants into the IL code for the hash codes.
Within the main switch statement where keypad entries are evaluated there are ~112 codes and I've reversed all of them. Writing hash algorithms is not straightforward and it's quite a simple one, since my app captured 2-3-4 variants of keycodes for the same hash value.
Regarding the most interesting entries at the top of the enum the ADMIN_ entries...those hash values are not handled by the application, maybe Samsung has another diag app or a different app which is using the same method.
The other thing I can think of is there are APIs in the diag app which one is sending the hash of a keycode to the given driver...I tried that but the ADMIN stuff did not worked that way either :-((
If anyone is interested I can post the resolved codes, but not sure if I can post it in the forum or not ;-)

Regsitry entry to enable SLDR mode
I found this definition in B44C7A84-5068-4b43-A1E5-F870A80F6FF8.rgu:
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\UsbFn]
...
"OsMode"=dword:0 ; 0 for Main OS, 1 for SLDR
....
Is the download mode == SLDR mode?
Since maybe we can set this entry "somehow", and upon next reboot we will get into download mode so we can flash the device?
So the question is, what is SLDR mode? Secure Loader mode? I don't know this, a more pro in this area should help out ;-)
UPDATE
I was able to read the value (0) and write it back (0). Did not tried to write 1 there

Hey guys. I know this thread is about programmatically enter downloadmode, but I wanted to try the 301k resistor trick and I can confirm it works on Samsung Omnia 7.
I used this guide. If you're gonna do that too, then you should pay attention to these things:
- The guide refers to pin 4 and 5 being closest to the headphone socket. But on the omnia 7, the headphone and micro-usb sockets are the other way around if you compare it to the Galaxy S. The guide is for the Galaxy S, so you should really pay attention to which pins you solder the resistor(s). This is the best picture on how you should solder the resistor(s).
- Many micro-usb cables have no wire for pin 4. Some connectors don't even have a pin 4. You should first verify that your connector has all 5 pins. If you only have 4 wires, then you have to dismantle the connector and solder directly on the back of the connector.
I switched off my Omnia 7. I plugged in my jig and it went to downloadmode immediately.
It's late now, so I will see tomorrow what I will be going to flash on it. There quite a few roms and I'm not sure which one I should use. I have to figure that out first.
If anyone has questions about how to make a jig, just ask. I know how to make one now.

You should post pictures, how to make such a cable. Thanks

FromOuterSpace said:
You should post pictures, how to make such a cable. Thanks
Click to expand...
Click to collapse
The picture I linked to in my previous post look pretty clear to me. It shows what pins you have to use. The guide I linked to contain all the other necessary details. If you have any specific questions about something that is still not clear, you can ask me.

[Hack] ByPassing compression for Wallpapper in Sense 2.5

Hello my friend,
As you know, when you select a wallpaper for Sense, it compress it and resize it to JPEG in a file named HomeBackground.img.
If you open this HomeBackground.img in a imaging software like Gimp or Photoshop, you can see that the quality is good on your PC but not when you set it as walpapper.
So i think that manila recompress it on the fly before display it.
I have disassembled the Manila.exe and the dll with ida pro in order to find any compression function but....no found !
Second step, i have download the manila kitchen and decompilled all the manila files. With a multi text file searcher, i have searched the occurence "HomeBackground.img" and i have founbd this file :
090a4ee8_manila
Here is the code of the file decompilled
Code:
-- Decompiled using luadec 3.2.2beta -- Fri Jun 10 23:16:41 2011
-- File name: 090a4ee8_manila
require("asyncimageloader")
require("shell_svc")
CachedImagePath = "\\Windows\\HomeBackground.img"
InterpolateOpacity = function(l_1_0, l_1_1)
l_1_1.Opacity:Interpolate(l_1_0, 20, 0, Interpolate_EaseOutQuad)
end
BackgroundWidth = 480
BackgroundHeight = 696
if _application.Store:GetStringValue(Lifetime_Permanent, "DevResolution") == "HVGA" then
BackgroundWidth = 320
BackgroundHeight = 410
end
LoadDefaultBackground = function()
trace("LoadDefaultBackground()")
InterpolateOpacity(0, HomeBackground)
if HomeTitleBar ~= nil then
HomeTitleBar.Opacity.value = 0
_application.Navigation.TabTrayOpacity = 100
end
end
BackgroundImageLoaded = function(l_3_0, l_3_1)
trace("BackgroundImageLoaded")
if l_3_0 then
if l_3_1 == 1 then
HomeBackground.TextureCoords.width = l_3_0.TextureCoords.width
HomeBackground.TextureCoords.height = l_3_0.TextureCoords.height
local l_3_2 = l_3_0.TextureCoords.width * l_3_0.Image.Width
local l_3_3 = l_3_0.TextureCoords.height * l_3_0.Image.Height
_StoreImageWidth = l_3_2
_StoreImageHeight = l_3_3
local l_3_4 = l_3_2 / BackgroundWidth
local l_3_5 = l_3_3 / BackgroundHeight
if l_3_4 < l_3_5 then
HomeBackground.Size.height = l_3_3 / l_3_2 * BackgroundWidth
HomeBackground.Size.width = BackgroundWidth
else
HomeBackground.Size.width = l_3_2 / l_3_3 * BackgroundHeight
HomeBackground.Size.height = BackgroundHeight
end
HomeBackground.Position.x = (BackgroundWidth - HomeBackground.Size.width) / 2
HomeBackground.Position.y = -(BackgroundHeight - HomeBackground.Size.height) / 2
HomeBackground:SetTexture(l_3_0.Image)
InterpolateOpacity(100, HomeBackground)
if HomeTitleBar ~= nil then
local l_3_6 = _application.Store:GetIntValue(Lifetime_Application, "ShowCacheHomePage")
if l_3_6 == 1 then
HomeTitleBar.Opacity.value = 60
_application.Navigation.TabTrayOpacity = 60
end
end
else
LoadDefaultBackground()
end
collectgarbage("collect")
BackgroundAsyncImageLoader = nil
elseif _StoreImageWidth and _StoreImageHeight then
local l_3_7 = _StoreImageWidth / BackgroundWidth
local l_3_8 = _StoreImageHeight / BackgroundHeight
if l_3_7 < l_3_8 then
HomeBackground.Size.height = _StoreImageHeight / _StoreImageWidth * BackgroundWidth
HomeBackground.Size.width = BackgroundWidth
else
HomeBackground.Size.width = _StoreImageWidth / _StoreImageHeight * BackgroundHeight
HomeBackground.Size.height = BackgroundHeight
end
HomeBackground.Position.x = (BackgroundWidth - HomeBackground.Size.width) / 2
HomeBackground.Position.y = -(BackgroundHeight - HomeBackground.Size.height) / 2
end
_application.Store:SetIntValue(Lifetime_Application, "Home.BackgroundMaskFadeOut", 0)
if HomeBackgroundMask.Opacity.value ~= 0 then
HomeBackgroundMask.Opacity:Interpolate(0, 20, 0, Interpolate_Linear)
end
end
BeginLoadBackgroundImage = function(l_4_0)
trace("BeginLoadBackgroundImage")
if Shell_HaveDRMRightsToFile(machineStatus.HomeBackgroundPath.Value, false) then
BackgroundAsyncImageLoader = AsyncImageLoader()
BackgroundAsyncImageLoader.Priority = TaskPriority_Normal
BackgroundAsyncImageLoader.OnComplete:connect(BackgroundImageLoaded)
BackgroundAsyncImageLoader:BeginLoadFile(l_4_0, false, true)
else
machineStatus.HomeBackgroundPath.Value = ""
machineStatus.CachedBackgroundPath.Value = ""
LoadDefaultBackground()
end
end
BackgroundImageResized = function(l_5_0, l_5_1)
trace("BackgroundImageResized")
trace("[homebackground] : HomePath = " .. tostring(machineStatus.HomeBackgroundPath.Value))
trace("[homebackground] : CachedPath = " .. tostring(machineStatus.CachedBackgroundPath.Value))
if l_5_1 == 1 and machineStatus.HomeBackgroundPath.Value ~= "" then
machineStatus.CachedBackgroundPath.Value = machineStatus.HomeBackgroundPath.Value
BeginLoadBackgroundImage(CachedImagePath)
else
trace("result = 0")
LoadDefaultBackground()
BackgroundAsyncImageLoader = nil
end
AnimationDelayHandler()
trace("BackgroundImageResized end")
trace("[homebackground] : HomePath = " .. tostring(machineStatus.HomeBackgroundPath.Value))
trace("[homebackground] : CachedPath = " .. tostring(machineStatus.CachedBackgroundPath.Value))
collectgarbage("collect")
end
machineStatus_OnCustomBackgroundUpdate = function()
trace("machineStatus_OnCustomBackgroundUpdate")
if _config_os == "windowsmobile" then
local l_6_0 = machineStatus.HomeBackgroundPath.Value
local l_6_1 = machineStatus.CachedBackgroundPath.Value
trace("[homebackground] : HomePath = " .. tostring(l_6_0))
trace("[homebackground] : CachedPath = " .. tostring(l_6_1))
if l_6_0 ~= l_6_1 then
if BackgroundAsyncImageFactoryLoader ~= nil and BackgroundAsyncImageFactoryLoader:IsRunning() then
BackgroundAsyncImageFactoryLoader.OnComplete:disconnect(BackgroundImageResized)
BackgroundAsyncImageFactoryLoader:Cancel()
BackgroundAsyncImageFactoryLoader = nil
collectgarbage("collect")
end
if BackgroundAsyncImageLoader ~= nil and BackgroundAsyncImageLoader:IsRunning() then
BackgroundAsyncImageLoader:Cancel()
BackgroundAsyncImageLoader = nil
collectgarbage("collect")
end
if l_6_0 == "" then
machineStatus.CachedBackgroundPath.Value = machineStatus.HomeBackgroundPath.Value
LoadDefaultBackground()
else
BackgroundAsyncImageFactoryLoader = AsyncImageFactoryLoader()
BackgroundAsyncImageFactoryLoader.Priority = TaskPriority_BelowNormal
BackgroundAsyncImageFactoryLoader.Quality = 100
BackgroundAsyncImageFactoryLoader.OnComplete:connect(BackgroundImageResized)
BackgroundAsyncImageFactoryLoader:ResizeImage(machineStatus.HomeBackgroundPath.Value, CachedImagePath, EncoderType_JPEG, 512, 512, true, false)
end
elseif l_6_1 ~= "" then
if BackgroundAsyncImageFactoryLoader ~= nil and BackgroundAsyncImageFactoryLoader:IsRunning() then
BackgroundAsyncImageFactoryLoader.OnComplete:disconnect(BackgroundImageResized)
BackgroundAsyncImageFactoryLoader:Cancel()
BackgroundAsyncImageFactoryLoader = nil
bRefreshBackground = true
collectgarbage("collect")
end
if BackgroundAsyncImageLoader ~= nil and BackgroundAsyncImageLoader:IsRunning() then
BackgroundAsyncImageLoader:Cancel()
BackgroundAsyncImageLoader = nil
bRefreshBackground = true
collectgarbage("collect")
end
if bRefreshBackground then
trace("[homebackground] : Change wallpaper too quickly and home and cache registry are the same, but loader is running, so load home background again.")
machineStatus.CachedBackgroundPath.Value = ""
machineStatus_OnCustomBackgroundUpdate()
else
BeginLoadBackgroundImage(CachedImagePath)
end
else
LoadDefaultBackground()
end
else
LoadDefaultBackground()
end
end
AnimationDelayHandler = function()
local l_7_0 = _application.Store:GetIntValue(Lifetime_Permanent, "Home.WallpaperMode")
local l_7_1 = _application.Store:GetIntValue(Lifetime_Application, "DelayAnimationEffect")
if l_7_0 == 1 and l_7_1 == 1 then
if _AnimationWallpaper then
_AnimationWallpaper:Show()
end
_application.Store:SetIntValue(Lifetime_Application, "DelayAnimationEffect", 0)
end
end
if _application.Store:GetStringValue(Lifetime_Permanent, "EnableLandscape") == "true" then
require("RotationTemplate")
homebackground_ScreenRotation = class(RotationTemplate)
homebackground_ScreenRotation.__init = function(l_8_0)
RotationTemplate.__init(l_8_0)
trace("+++++++[homebackground] : __init")
end
homebackground_ScreenRotation.OnScreenRotation = function(l_9_0)
trace("+++++++[homebackground] : OnScreenRotation")
if _application.Orientation == ScreenOrientation_Portrait then
BackgroundWidth = 480
BackgroundHeight = 696
elseif _application.Orientation == ScreenOrientation_Landscape then
BackgroundWidth = 805
BackgroundHeight = 376
end
BackgroundImageLoaded(nil, nil)
end
end
if _config_os == "windowsmobile" then
if _application.Store:GetStringValue(Lifetime_Permanent, "EnableLandscape") == "true" then
_homebackground_ScreenRotation = homebackground_ScreenRotation()
end
machineStatus.HomeBackgroundPath.OnValueChanged:connect(machineStatus_OnCustomBackgroundUpdate)
machineStatus_OnCustomBackgroundUpdate()
end
At the line 141 tou can see this :
Code:
BackgroundAsyncImageFactoryLoader:ResizeImage(machineStatus.HomeBackgroundPath.Value, CachedImagePath, EncoderType_JPEG, [B]512[/B], [B]512[/B], true, false)
* If you delete this line, the wallpaper don't display !
* The 512,512 are the width and height values, so i think it's better to replace them by 480 , 696 ( the real width and height)--> Warning, you need to use a walpapper with a heigh and width of 480x696
With this, the image will be better.
BUT it's not finish !
When you modify this file and recompile it, you can see thaht you walpapper is not cropped but, the quality is always not good.
Look at this :
And with a zoom :
--> So you can see that there is even a compression thaht destruct the quality, but where is it ?
I would like to find a way of bypassing a function of recompression but i don't found it. I would like to investigate on this project with some people, so if anyone have some informations about this, it will be very great !
So, you can contact me on this thread or by PM !
If you want to help me, it's very simple :
1) Download the manila kitchen here : http://forum.xda-developers.com/showthread.php?t=528548
2) Copy all your *manila* files on the "source" folder.
3) Read the .doc or the .pdf document that explain how decompile this file ( it's very very easy)
4) Investigate about improving walpapper quality
I know that the truth is near, but i need some help !
Thanks a lot for all people that could help me to create this hack.
Best regards,
Nixeus

Update post 1

Hi Nixeus,
this all is done once before here on xda. But you have to know it, otherwise you will not find it.
Link 1 - HDwall 0.29 original thread -> maranell0
Link 2 - HDwall for VGA -> mwalt2
Link 3 - background for all tabs (bg4all) -> cookiemonster our good old and missing friend
Hope that helps you out...

Hello and thanks for your answer.
I don't agree because HDWALL use a software in order to create a png in a manila file, it's note the same method....
Instead of displaying the homebackground.img on the home, you need to choose the png in hdwall, and after hdwall insert this png in a manila file, it's note the same method and it don't function good on the latest version of manila.
That's why we need to create a good hack.

Nixeus said:
Hello and thanks for your answer.
I don't agree because HDWALL use a software in order to create a png in a manila file, it's note the same method....
Instead of displaying the homebackground.img on the home, you need to choose the png in hdwall, and after hdwall insert this png in a manila file, it's note the same method and it don't function good on the latest version of manila.
That's why we need to create a good hack.
Click to expand...
Click to collapse
You are right, it is not the same way. It was only an idea, because on my latest ASIA Rom V2.5 WWE Full from Laurentius26 the HDwall system is working perfect without any issue. Also the wallpaper changing with the cab files and the change tool from HD wall is working. We had add this function in CHT, but in the mean time i am working on different roms, so i don't used CHT the last 4 weeks. Badly but true . Otherwise we have to search further in that case. I will read again you 1st posting...

Thanks for you help
Maybe ChainFire or CookieMonster could help us !

Is the wallpaper quality worse with the resize mod or the same?

sharkie405 said:
Is the wallpaper quality worse with the resize mod or the same?
Click to expand...
Click to collapse
Yes I would like to know too?