Related
Hi. I am relatively new with the PDA scene and as much as I would have loved to read an answer to my question from some other thread instead of starting a new one, I could not do it cos there are none. At least in "idiot's guide" style.
To the question that is stated in the title. As much as I have understood, there are (at least) three storage areas on a device (mine being Vodafone v1520) - the ROM, the EXT ROM and the files that we see on under "My Device" in Explorer. Some of the files have been marked as "ROM" if to look at the properties and those cannot be deleted (at least I haven't found any way) but they can be overwritten (with Resco or smth). The point of my question is that when I overwrite the WELCOME.GIF file (marked as ROM file, it's VF splash screen) it does overwrite it nicely (confirmed) but when I hard reset, it's back. Although I don't understand also why after overwriting I still see the VF logo instead of my own file, that is a separate issue.
The reason I am asking this is that nobody in this forum has been able to answer me how to unlock the EXTROM part on that ASUS P550 that I have. So I thought maybe if I change the STARTER.EXE or GENERALINSTALLER.EXE to something pointless, the EXTROM part won't be installed.
Although I suspect the VF logo is displayed from EXTROM part while booting, cos there is nowhere else that same file in normal storage.
Summary:
1) Does changing files marked as "ROM" really change ROM files or is it until the next hard reset and why?
2) Does anyone know how to unlock and unhide the EXTROM part on ASUS P550?
3) Does anyone know where the VF splash screen comes from while booting?
If anyone has ANY information on these issues, PLEASE enlighten me. It seems that there are a lot of senior members who have the knowledge but are quite unwilling to share it. I don't know why but it seriously sucks that they don't reply to threads or PM. I thought this forum was for helping each other, not giggling behind the screen: "I know something You don't". At least that is the impression that I have recently gained when trying to contact people that have the knowledge.
Thanks.
aiiro
The answer to your "stupid" question - "are ROM files REALLY ROM files" - is NO.
The question is not stupid and the files are really not the files.
Actually you have only the information about the files in ROM - the name, the size and other attributes. That's it.
You are not really overwritting anything when you copy the different file with the same name to ROM.
If you somehow dump the ROM from your device - you'll get real files.
Welcome Gif can permanently be changed only in dump.
Unlocking EXTROM .... I am not sure that I got what you mean. And why do you want to do that. But do the following: with Resco Registry go to
HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\TRUEFFS_DOC2\FATFS
Change MountHidden value from 1 to 0
You will be able to see the EXTROM content.
VF splash screen definitely comes from Windows folder of your device while booting - it's a part of the ROM.
OK, thanks for a quite thorough reply, but I still don't get it then - why does Resco (or similar prog) ask to overwrite the file? OR, if it doesn't overwrite it, how do I see the new file in Windows folder and the prog looking for splash screen file does not?
The EXTROM fascinates me because after hard reset the device is installing some "Auto Installation packages" and as far as I have found out those come from the EXTROM. I suspected that the WELCOME.GIF came from there too but now I am not sure. Might have to dump the ROM somehow and look into it but there are not many people with P550 and like I said those who have, don't have the willingness to help with that.
BTW, thanks also for the tip about the registry, but I have tried all the registry tweaks that I have found (including the abovementioned) but none of the works...
Thanks again and looking forward to Your (or anyone else's) comments.
aiiro said:
OK, thanks for a quite thorough reply, but I still don't get it then - why does Resco (or similar prog) ask to overwrite the file? OR, if it doesn't overwrite it, how do I see the new file in Windows folder and the prog looking for splash screen file does not?
Click to expand...
Click to collapse
Resco has been done like you have!
Try to do the following: copy your own Welcome.gif to Windows folder. You will be prompted to overwrite. Say yes. Then simply delete that file. It will not disappear - the old version of file will become visible again. ROM is not a number of files - it is one file which contains a copy of the data that later will be written (flashing process) straight to a read-only memory chip.
(Pay attention on my words "read-only")
Imagine yourself a wall painted with a hell of 100 dollar bills. You can see them. But you cannot take one of them. You can even glue you own bill upon the drawn one. It will work. But when you wash the wall (hard-reset) - your real paper bill will be washed down and the old painted one will appear (sorry for metaphor)
BTW, thanks also for the tip about the registry, but I have tried all the registry tweaks that I have found (including the abovementioned) but none of the works...
Thanks again and looking forward to Your (or anyone else's) comments.
Click to expand...
Click to collapse
Nothing works probably cause the registry is write-protected. Unlock your registry by changing the following:
HKLM\Security\Policies\Policies\00001001 = 1
HKLM\Security\Policies\Policies\00001005 = 40
But! You would do it with the digitally signed regedit. For example - one is attached. Unzip it to your device, run it, change the security policy settings, reboot. Then try to tweak your Asus again.
The attached regedit has OEM Sign 2005 - hopefully it will work for you.
Thank You for a thorough explanation and especially for the metaphore - it was very helpful.
But about the registry - wow... I mean I haven't even heard of unlocking registry...
As usually, answers are generating new questions. The ones I have now are:
1) How come some of the registry tweaks made with Resco still work even now - like showing the clock instead of battery (changing the TBOpt key) etc and the values are still there after soft reset?
2) Resco is also digitally signed, isn't it?
3) If I use this app, will hard reset still create a clean registry? (The answer to this probably is "yes" but I still ask just to be sure).
4) Can I seriously f**k up something with this method?
Thanks in advance.
But
aiiro said:
... answers are generating new questions. The ones I have now are:
1) How come some of the registry tweaks made with Resco still work even now - like showing the clock instead of battery (changing the TBOpt key) etc and the values are still there after soft reset?
2) Resco is also digitally signed, isn't it?
3) If I use this app, will hard reset still create a clean registry? (The answer to this probably is "yes" but I still ask just to be sure).
4) Can I seriously f**k up something with this method?
Click to expand...
Click to collapse
Read your PM - sure I don't have any subscriptions, but it's OK (I mean PM) - it works.
So:
1. The point is that not the whole registry is write protected - only several "important" parts mostly in HKLM. Normally - if you change someting in HKCU - it will work even with the protected registry. The vendor only protects the keys and values that can cause some "critical" system changes.
2. If to tell the truth - I know that Resco has digital signature - but anyway the permission level of it does not allow you to modify the protected keys. So that's why I offered you to use Regedit, signed with the customizers.
3. For sure - after HardReset you will return to factory defaults completely - it means you registry will again become clean and write-protected.
4. It depends upon what you mean writing "seriously". The worst thing - to damage the bootloader, but you will never do that modifying the registry. So - feel free to do whatever you want - you will always be able to return to factory defaults.
OK, thank You very much for the explanation! I have bookmarked like 200 pages related to PDAs, which means that if even only every 10th page gets bookmarked, I have gone through thousands of pages in 4 months and I haven't stumbled on this information before. So everything You have enlightened me about here is most useful, thanks again!
I hope I will not push it but since You have been so helpful and seem to know stuff, I am risking asking some more questions. First of all, would You happen to know a good "idiot's guide to flashing ROM"? I have read those on the wiki but as they are for HTC devices and asus mobile club russia does not have any basic explanation in English, it's pretty hard to catch the idea. I know that much that there is a PC involved with some kind of programs etc, but that's about it. I don't even know what the hell is a bootloader. There also isn't any good PDA architecture drawings lying around in the net
The second question is also related to hardware. I have the Vodafone v1520 as mentioned above and it has a small annoyance - the earpiece volume adjustment during call does not work. The slider moves and I hear the clicks getting louder or quieter but the volume level of the caller voice does not change. I took it to a repair shop and they told me that it's a faulty hardware but I know that there are people with exactly the same problem in this forum and I find it hard to believe that they installed some kind of faulty earpiece on all these devices. Or is that possible? What do You think?
Thanks.
aiiro
Sorry dude but both your last questions are about the specific device - your Vodafone. To answer - I should buy Asus P550 and get an experience first. It's only 700 bucks in my country but I am not sure that I really wanna have it. My current device (pretty old now) is P525 and the next one will probably be Diamond or something better and more expensive.
Second thing - I am not IT professional - I am just a user. OK, I always use my own (cooked) ROMs but it does not mean that I can give the answers to all your questions!
OK, I knew I was pushing it a little bit and in no way did I mean that You should make some kind of spendings. I just thought maybe You had any ideas and maybe ASUS devices are similar enough that they are compatible ROM-wise with each other or something like that.
Anyway, thanks for those thorough replies - You have been most helpful! As soon as I will have some time I will try the registry things out.
Thanks again and good luck!
try to install this cab file ,I make it .you can QQ me by my QQ:421264988 my E-mail:[email protected]
i'm sorry ,I chinese ,and my English is very poor
安装这个CAB文件试试,我的手机也是P320,安装完解锁成功,但在删除程序里看不到之后安装的程序,欢迎和我交流,我的QQ:421264988 E-mail:[email protected]
对不起,我是中国人,我的英语很差
Modified registry values don't survive reboot?
Try switching the device off before reboot.
The registry is not flushed to disk at every write.
And search the net for
flushing registry pocketpc
Click to expand...
Click to collapse
newxda-new said:
Try switching the device off before reboot.
The registry is not flushed to disk at every write.
And search the net for
Click to expand...
Click to collapse
So if you reset the handheld without putting it into suspend mode before, you risk losing configuration data (registry settings)?
HTC new drivers Mango Rom will not allow old system apps to get root access, like TouchXplorer does not work on 4.xx above roms.So these days i found a way to make my custom rom based on htc 5.10 rom work perfect with old system apps.
Step 1
get an old htc offical rom, like 1.xx, get a htc offical 4.0x rom.dump them.copy HTCFileUtility.dll and HTCRegUtility.dll from 1.xx rom dump, and HTCProvisionDrv.dll from 4.0x rom dump.(they are both in OEM\HTC_AppDrivers)
Step 2
use the three files(modules) copied above to replace your custom rom, if u are using 4.0x rom as your base skip step 3.
Step 3
replace the ApprovedlistDB.db(in OEM\CSConn_DB) by my uploaded one.
Step 4
use OSBuilder to relloc your modules, or relloc them by yourself(just like me, cause OSBuilder is hard for me to understand how to use it)
Step 5
package your custom rom, and flash it, then you will get a new rom that TouchXplorer and RegistryEditor(this works much faster than before) can work like charm
Step 6
thx DFT bring us HSPL & Julien Schapman bring us magic system tools!
remarkable，thx 4 sharing
Would be awesome if there was a way to restore the old versions in-place without re-flashing the whole phone. CAB maybe? I don't think you can overwrite ROM modules any other way. I've avoided installing the latest HTC updates because I've written a couple apps that rely on the File and Reg DLLs, but that also means I don't have things like the Connected Media app working.
GoodDayToDie said:
Would be awesome if there was a way to restore the old versions in-place without re-flashing the whole phone. CAB maybe? I don't think you can overwrite ROM modules any other way. I've avoided installing the latest HTC updates because I've written a couple apps that rely on the File and Reg DLLs, but that also means I don't have things like the Connected Media app working.
Click to expand...
Click to collapse
if you can put files in \windows folder, and change reg key under HKLM\Drivers\BuiltIn\, you can make it works without flash a rom.
cause we could get drivers from htc orginal update cabs then rename them to put into \windows folder and change reg key to make these drivers load, no need to replace.
Well, if you care about this at all, you're already interop-unlocked.
If you're interop-unlocked, then you can set registry values and move files (using provxml).
So... yes, this sounds pretty exciting. Having the official HTC updates but still being able to use TouchXplorer would be awesome.
So, would it just be a matter of copying the old files under new names to the Windows folder and changing the "Dll" value of "HKLM\Drivers\BuiltIn\HTCFileUtility" and such? Or would something need to be done with the DB as well? I'm not sure if that can be changed on a running device.
Tell me what needs to be done and I'll create a tool to do it.
GoodDayToDie said:
Well, if you care about this at all, you're already interop-unlocked.
If you're interop-unlocked, then you can set registry values and move files (using provxml).
So... yes, this sounds pretty exciting. Having the official HTC updates but still being able to use TouchXplorer would be awesome.
So, would it just be a matter of copying the old files under new names to the Windows folder and changing the "Dll" value of "HKLM\Drivers\BuiltIn\HTCFileUtility" and such? Or would something need to be done with the DB as well? I'm not sure if that can be changed on a running device.
Tell me what needs to be done and I'll create a tool to do it.
Click to expand...
Click to collapse
you are on the way, m8.
get drivers from htc update cab, then u'll get files not modules
Code:
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCFileUtility]
"Dll"="HTCFileUtility_new.dll"
if you make new HTCFileUtility.dll work, you will have enough power to replace files.
then make your new reg drivers work.
Code:
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCRegUtility]
"Dll"="HTCRegUtility_new.dll"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\HTCProvisionDrv]
"Dll"="HTCProvisionDrv_new.dll"
thanks for sharing, waiting for this method for along time.
Thanks ted. I'll update my backup (so I can roll back to working version if I need to) and go hunt down those files.
I don't think I'll need to overwrite HTCProvisionDrv, the current version seems to work just fine. In fact, if it doesn't, there won't be any way to do the overwrite. It's just the registry and filesystem drivers that were broken.
Now I'm wondering what the other HTC drivers do. There's a specific one for Connection Setup and for HTC YouTube, plus drivers for "HTCBgService" (a way to run tasks in the background, I assume) and "HTCVersionUtility" (probably not useful, but maybe?). It would be interesting to examine the APIs of those.
For that matter, it would be interesting to examine the API of things like the provision driver. It appears to have full permissions, but the DMXMLCOM.DLL library used to interface with it has a fairly limited API (no way to get the result of a provxml query, for example). Talking directly to the driver may work better.
Anyhow, off to find the correct CAB!
Sounds pretty awesome! New drivers in Mango with support for old apps - cool! Really hoping for a tool to do this, i've never cooked my own ROM, I solely rely on the experts for this
Hi Ted (or anybody), do you knwo where I can get the pre-Mango HTC cabs? All the cabs I've been able to find are for the Mango HTC updates, and have the wrong versions of the files.
EDIT: Found some that might work. They aren't labeled but the datestamp is from January.
Pretty sure xboxmod has a thread with all the official cabs linked somewhere on xda.
Sent from my HD7 T9292 using XDA Windows Phone 7 App
Thanks. I'll see if the files I found work. They're old enough, and are supposedly from an official update, but it's hard to be sure. Their file sizes are different from the ones in the latest update, but not by much.
The real trick, of course, is seeing whether I can install my own drivers at all or not. I know I can place files and change registry values, we just have to see if the phone will use them.
ted973 said:
HTC new drivers Mango Rom will not allow old system apps to get root access, like TouchXplorer does not work on 4.xx above roms.So these days i found a way to make my custom rom based on htc 5.10 rom work perfect with old system apps.
...
Click to expand...
Click to collapse
Any chance you would release your custom ROM? Can you make one for Trophy, only one using 5.10 version are Ansar's, your's sounds nicer!
Well, I didn't find Xboxmod's cabs, so I'm using the ones linked in Heathcliff74's thread. Unfortunately all the reliable ones are pretty recent, so I don't think they'll work. Last resort I'll try pulling them off my phone's filesystem, but that gets weird with modules.
I've successfully broken TouchXplorer and Connection Setup, and then fixed them again. I think this constitutes progress. Next step: try some older drivers, and see if I can install them without breaking anything. If so, then I'll try updating my phone with the official HTC update, and see if it's still working. If so, I'll clean up the XAP a little and publish.
EDIT: Additional discovery: Connection Setup relies on HTCFileUtility.dll. Installing the broken FileUtility driver causes Connection Setup to complain that there's no database installed on the phone, and then quit. Now I *really* wonder what HTCConnectionSetUp.dll is used for. Also, I'm not gonna touch the Provision driver unless I have to; this testing takes long enough when every step requires a reboot. If I mess up the provision driver I'll probably need to restore the phone backup.
EDIT2: The new HTCConnectionSetUp.dll driver is several times the size of the old one, but it doesn't seem to change how Connection Setup works when I use it. In particular, it still processes CustClear.provxml.
EDIT3: Still not working, even with very old drivers (January). I have a few possible ideas as to why, but it looks like I may need to run this with drivers from my "working" phone instead of from a CAB.
OK, I haven't been able to get this working with any of the DLLs I've been able to pull from CABs, and the DLL modules on the filesystem can't be moved, renamed, or read (ERROR_ACCESS_DENIED when I try to read one using ComFileRW.dll).
I either need the right CAB, the special sauce to make it work with the wrong CAB, or a way to extract those modules as files. I suspect it's at least partially a "special sauce" situation - the errors I get when I try using different drivers are not the same as the errors I get with the official update that breaks third-party apps trying to use those drivers.
I would *REALLY* appreciate some assistance with this. It has the potential to provide an easier interop-unlock (if the official update doesn't reset the driver DLL paths) and even if that doesn't work, it would be a big step forward for HTC homebrew. However, I know nothing about ROM assembly - not even how to extract a file from a shipped ROM. I'm trying to learn, but if somebody wants to point me in the right direction that would be a big help.
EDIT: I managed to extract the ROM module (took some doing; HTCRIE will crash at the drop of a hat if you aren't careful). I can't rebuild the file though - recmod doesn't seem to like it.
if you can use Provxml i have some way to replace module in \Windows dir
1.
<wap-provisioningdoc>
<characteristic type="Registry">
<characteristic type="HKLM\System\Explorer\Shell Folders">
<parm name="My Ringtones" value="\Windows" datatype="string" />
</characteristic>
</characteristic>
</wap-provisioningdoc>
Click to expand...
Click to collapse
copy this to notepad and save as File.Provxml file
2.Install DiagProvXMLv0.91
3.Use Chevron Ringtone Installer to copy .Provxml to your phone
4.Run DiagProvXML and go to " File Operations" tab , select Copy (to isoStore)
in Source Path use
\My Documents\My Ringtones\
Click to expand...
Click to collapse
and Source File use
File.Provxml
Click to expand...
Click to collapse
,,
Press (+) to save ,,
and now go to provxml tab and Press Publish (disk icon) ,,
go to iso store tab and Hold press at File and select Excute ,,
restart your phone and now you can use Chevron Ringtone installer to Add File you need to \Windows\ (sure as module , and defaultcert.dat for cab sender)
Best Regard
PPJD
@peeks20: Thanks (sort of) but your method is both overly complicated and doesn't solve the actual problem. If you're already interop-unlocked (and you have to be, to use DiagProvXML), then it's trivial to write a small app that just uses DMXMLCOM.dll to process whatever provxml commands you want. That includes copying files to the Windows directory.
The problem is that I'm not sure what file to copy, and I'm not sure it'll work even if I have the right file (I've tried multiple official files from various update CABs, and none of them have worked). There's probably either a version-matching function that's getting in the way, or a database somewhere that needs to register the new drivers (beyind just changing the path in the Dll value in the registry). Heck, maybe it's both. The point is, it doesn't work.
Now, if there's something about deploying the files using the Chevron ringtone installer instead of using pvroxml that will make all the difference, that would be cool. I really doubt it, though. The files copy just fine, and can be accessed and opened. They jut don't actually work. I get the same errors as if I point the Dll path in the registry to completely bogus paths ("Dll"="ThisFileDoesNotExist.dll").
GoodDayToDie said:
@peeks20: Thanks (sort of) but your method is both overly complicated and doesn't solve the actual problem. If you're already interop-unlocked (and you have to be, to use DiagProvXML), then it's trivial to write a small app that just uses DMXMLCOM.dll to process whatever provxml commands you want. That includes copying files to the Windows directory.
The problem is that I'm not sure what file to copy, and I'm not sure it'll work even if I have the right file (I've tried multiple official files from various update CABs, and none of them have worked). There's probably either a version-matching function that's getting in the way, or a database somewhere that needs to register the new drivers (beyind just changing the path in the Dll value in the registry). Heck, maybe it's both. The point is, it doesn't work.
Now, if there's something about deploying the files using the Chevron ringtone installer instead of using pvroxml that will make all the difference, that would be cool. I really doubt it, though. The files copy just fine, and can be accessed and opened. They jut don't actually work. I get the same errors as if I point the Dll path in the registry to completely bogus paths ("Dll"="ThisFileDoesNotExist.dll").
Click to expand...
Click to collapse
i uploaded HTC Appdrivers from Mozart 1.32 & 4.06 update cabs, maybe you can continue your test
Thanks, I'll give them a try. However, I've got to ask - what is Approvedlist.db, and if you have to modify it for a custom ROM, would I also need to modify it for this app? I can't shake the feeling that there's more to installing a driver than just changing a registry value.
GoodDayToDie said:
Thanks, I'll give them a try. However, I've got to ask - what is Approvedlist.db, and if you have to modify it for a custom ROM, would I also need to modify it for this app? I can't shake the feeling that there's more to installing a driver than just changing a registry value.
Click to expand...
Click to collapse
hard for me to explain this in english, this file decides which Registry keys allow apps to change.its format changed in 5.xx rom, so RegistryEditor v1.2.0.0 didn't work on these roms, we need to use old version HTCRegUtility & HTCProvisionDrv and old format ApprovedlistDB.db to make htc apps and 3rd Registry tools works perfect, that's why you need to replace ApprovedlistDB.db.
I AM NOT RESPONSIBLE FOR ANY NEGATIVE IMPACTS OR CONSEQUENCES ON YOUR PHONE IF YOU SO CHOOSE TO USE THIS GUIDE.
I own the ZTE U950 and had realized that there is very little information (in English) on how to do anything beyond stock for this incredible phone. After hours of research and translation I was able to figure out everything needed to get this phone to a "better" state. Since then I - and other XDA members - have been trying to keep the ZTE U950 alive...
ZTE U950 SPECS
NVIDIA TEGRA 3 (1.3MHz)
1GB RAM
4.3" Display (480x800)
5MP Front Camera/0.3MP Back Camera
Android OS 4.0.4
DRIVERS
Here are the "Join Me" drivers so that your PC can recognize the ZTE U950.
KERNEL
Stock - This is the stock kernel's source file.
Custom - This is a custom kernel for stock ROMs that can be OC'd to 2.5GHz.
ROOT
1) Make sure you have USB Debugging Mode and Unknown Sources checked in your phone Settings.
2) Connect your phone to your PC.
3) Download and open Genotools.
4) The program will open, click the 4th tab (last tab on the right).
5) Ensure that your phone is plugged into your PC.
6) Click the 2nd ROOT button.
7) A popup window will appear, press OK.
8) Your phone will then have a popup window, click the "Restore My Data" option.
9) The phone will restart several times, leave it for a few minutes.
10) This is the odd part... The phone will likely not stop restarting, and when you try to click the unlock key for the screen, it will automatically restart. Disconnect the phone. It should continue to restart.
11) Force the phone off.
12) Restart the phone.
13) If you have SuperUser, you are then rooted. If not, repeat these steps.
ROOT - NEW VERSION #1 (UNTESTED!):
1) Download the file here.
2) The instructions read verbatim are, "1 If your phone is not acquired before the ROOT privileges, we choose 1 root [next line] 2 after enter". Which I assume means click root, then enter...
ROOT - NEW VERSION #2 (UNTESTED!):
1) Download the root kit here made for the ZTE U950 (it uses the Chinese recovery), and extract to your desktop.
2) On your phone, go into Settings and enable USB Debugging under Developer options.
3) Connect the phone to your PC (Windows OS should fail to recognize the device).
4) Run either DrvInst_x64.exe or DrvInst_x86.exe. If you are unsure what you have, run both, the wrong one will fail with an error message.
5) After installation, unplug and replug your phone.
6) Go into Device Manager. You should be able to see a "ZTE TD Handset ADB Interface" under the "Android Phone" section. If you don't, reinstall the drivers again.
7). To root, simply run the U950_Root.bat file, and follow the instructions.
RECOVERY (CWM/TWRP)
1) Download the Chinese CWM or English TWRP recovery.img and place it into the root folder of your external SD card.
2) Download a terminal emulator. (If you are unable to download one, use the APP TRICKS described near the bottom to install a terminal emulator onto your phone.)
3) Open the terminal emulator.
4) Type in "su" then hit the return button.
5) Now type in the following:
dd if=/sdcard/recovery.img of=/dev/block/platform/sdhci-tegra.3/by-name/SOS
(and press the return button)
6) There should be a few lines beginning with something like 14052 or 14272, if not, then the above input was not typed correctly. If so, the recovery should now be installed.
GET INTO RECOVERY
1) Turn the phone off.
2) Hold the Power button + Volume Down button. When the ZTE logo comes up, count two seconds and then let go of the buttons.
3) The phone will enter into recovery. Use the Volume rockers for up and down and the power button to choose (if on CWM), or simply touch the buttons (if on TWRP).
4) I will describe the standard processes here if using CWM - the menus are top-to-bottom on the phone, which are written left-to-right here:
The Main Menu:
[*] Reboot system now
[*] Select zip to flash/install
[*] Wipe data
[*] Wipe cache
[*] Backup and restore
[*] Flash memory/Format
[*] Advanced setting
[*] Turn off phone
The Zip Menu:
[*] Install from zip
[*] Install from internal
Wipe Date:
[*] Confirm wipe data
[*] Do not wipe data
Wipe Cache:
[*] Confirm wipe cache
[*] Do not wipe cache
Backup and Restore:
[*] Backup
[*] Restore
ROMS (ALWAYS MAKE A BACKUP BEFORE FLASHING ANY ROMS TO THIS PHONE!)
Factory ROMs (in order of release)
U950V1.0.0B02
U950V1.0.0B14
U950V1.0.0B18
U950V1.0.0B22
U950V1.0.0B04
U950V1.0.0B05
Custom ROMs (in no particular order)
6240-jingjian
MIUI3.3.7
CustomRom-B14
DeodexedMIUI3.3.7
EN&CN-MIUI3.3.7-msdfyc4zwg
MIUI3.2.8-ysdfyc4zwg
Signed-121223-MZECN-CookedROM
SignedROM
V2.0.0-Hiapk-XC-iSignFile
12-21ROM
4.2CameraROM
RandROM
MIUI1220
V2-MaunJ
CM10/.1 - HeatSka Edition
This should be listed under ROMS, but I felt that it needed its own section. Ska and I worked on this for quite some time getting all the kinks worked out. We did not create the original version of this unofficial Cyanogenmod port, but the original had many issues and was not maintained after its initial release. All the major problems have been worked out in our HeatSka edition.
The ROM was initially CM10 (4.1.2), but it has been mixed with files that list it as 4.2.2 (CM10.1) under the information section. In either case, it is Jelly Bean! Aside from the fixes we have implemented, there are also numerous tweaks and mods for UI speed, network speed, battery consumption, app installs, and much more. There is almost no theming, just enough to know that this is our enhanced (and better) variation.
The only known issue that may arise is CPU throttling. We have included an app called, "LGP880 Booster". This app will allow a CPU speed boost when turned on, with a temperature threshold to prevent overheating. If you wish to save battery, only enable this app when playing a game or using CPU-intensive apps.
DOWNLOAD: CM10.1/2 - HeatSka
FLASH A ROM
1) Download a ROM.
2) Place the ROM in the root of the phone's SD card.
3) Enter into recovery.
4) Wipe data.
5) Wipe cache.
NOTE: Wipe data and cache are the Factory Reset button in TWRP.
6) Follow the menus to get to the ROM in the SD card.
7) Click the power button to choose the ZIP if on CWM (or just push the designated button on TWRP).
8) The ROM is being flashed.
9) Follow the left arrow (the last selection) on the menus to get back to the main menu.
10) Choose the first option on the main menu to reboot on CWM (or click Reboot followed by System in TWRP).
NOTE I: The ROM will probably be in Chinese. Find the Settings icon and click it. Go down to the Language & Input setting and click it (there is a capital "A" next to it). Click the top setting and choose the desired language.
NOTE II: There may not be an English keyboard available, so download this 4.2 keyboard ZIP file and flash it in recovery.
INSTALL GOOGLE PLAY
1) Download and install a file explorer like ES Explorer (free) or Root Explorer (paid). (If the phone is unable to download a file explorer, use the APP TRICKS described near the bottom to install one onto the phone.)
2) Download and take the three files from the RAR file for Google Play and place them in a folder on the phone that can easily be reached with a file explorer.
3) Open up a file explorer.
4) Move the three files to the "/System/App" folder on the phone.
5) Give the three files each the same permissions (Read for all three groups, and Write for User).
6) Restart the phone and Google Play should now be installed.
Notes: a) There are cases where two Google Play store icons may appear. They should both work and not cause problems.
b) If the store does not show, redo the process above.
c) This trick does seem to work on other Android devices as I have successfully done this on a Galaxy Note N7000.
INSTALL FACTORY ROM
1) Download a Factory ROM from above and place the "update.zip" file in the root of your external SD card.
2) Go to Settings.
3) Go down to About Phone and click that.
4) Click on System Updates.
5) Remove the check mark.
6) Click OK.
7) The phone should restore to whichever factory update file was used.
APN FIX (MOBILE DATA FIX)
If your mobile data is not working then use this method to fix your APN:
1) Revert to stock ROM (or any custom ROM where mobile data does work).
2) Download and open a file explorer like Root Explorer or ES Explorer.
3) Go to /system/etc
4) Copy "apns-conf.xml".
5) Go to /sdcard/
6) Paste "apns-conf.xml".
7) Flash ROM.
8) Download a file explorer and open it.
9) Copy "apns-conf.xml".
10) Go to /system/etc
11) Paste "apns-conf.xml" (overwriting the existing file).
12) Reboot the phone.
13) Mobile data should now work.
GAME SUPPORT FOR ZTE U950 (WORKS ONLY FOR U950V1.0.0B02)
Note: I have not tested this. Apparently the first firmware version of this phone is not recognized by Google Play for certain Tegra games. If this occurs, try the following method.
1) Make a backup of the System folder. (It is easier to make a Backup of the entire ROM in recovery...)
2) Insert the build.prop file from this file.
3) Clear the Data for Google Play store (Settings > Apps > Google Play > Clear Data).
4) Reboot the phone.
5) When opening Google Play it should make give their agreement again. If it doesn't, then Data has not been cleared.
6) The rows modified in the build prop is as follows:
Desire ro.product.model = X
HTC ro.product.brand =
Desire ro.product.name = X
Desire ro.product.device = X
...
HTC ro.product.manufacturer =
AGAIN, I HAVE NOT TESTED THIS SO USE AT YOUR OWN RISK!
APP SUPPORT FOR ZTE U950
Note: Some apps will throw package errors after downloaded and then will not install. This method will help a lot of these errors from occurring. It doesn't work for all, but it will for some [tested with Dead Trigger 2].
1) Download this file.
2) Use a file explorer like ES Explorer (free) or Root Explorer (paid) and put com.google.android.maps.xml in /system/etc/permissions
3) Put com.google.android.maps.jar in /system/framework
4) Reboot the phone and now apps should install without issue.
DEAD TRIGGER 1
1) Enable graphics details to High in Setup/Others.
2) Exit the game.
3) Use a file explorer like ES Explorer (free) or Root Explorer (paid) and go to /data/data/com.madfingergames.deadtrigger/shared_prefs/
4) Edit the com.madfingergames.deadtrigger.xml file.
5) Change <int name=”UnityGraphicsQuality” value=”1″ /> to <int name=”UnityGraphicsQuality” value=”2″ />
6) Change <int name=”OptionsGraphicDetail” value=”2″ /> to <int name=”OptionsGraphicDetail” value=”3″ />
7) Save the com.madfingergames.deadtrigger.xml file.
8) Remove all write permission on User, Group and Other for the com.madfingergames.deadtrigger.xml file.
9) Delete the com.madfingergames.deadtrigger.xml.bak file.
Note: This technique works on any non-Tegra device.
APP TRICKS
If apps cannot be downloaded normally (from Google Play), this guide will show an alternative method on how to install them:
1) Download the necessary apk file online.
2) Open the 4.2LatinIme.zip with 7zip or WinRAR and delete the keyboard APK (or keep it if not installed yet).
3) While the ZIP is open go into "/Sytem/App" and place in it any APK you want installed.
4) Boot into recovery.
5) Flash the ZIP file.
6) Reboot and the app(s) should be installed.
Note: I have noticed that certain apps do not flash properly so an alternative APK needs to be downloaded. However, once you have the right apps to install Google Play, you should be able to download any apps from the store.
HARDWARE FIXES BY SKA
NOTE: Always work without the battery attached to the phone.
SIM Card No Longer Works
INFO: There is a diode which provides voltage to the SIM card. Somehow it has become loose, which disallows current to the SIM. Thus, the baseband cannot recognize the SIM card any longer.
FIX: The easiest way to fix and check something is to "re-flow" the PCB (printed circuit board). The modem soldering must be re-flowed in order to reconnect the loose diode and re-allow voltage back to the SIM card.
Touchscreen Not Displaying
Open up your phone. If you don't know how, then you won't be able to continue...
There are three connectors on the left soc side. Check the upper connector near the audio jack and try to seat with a pair of tweezers very gently.
There is a white line on every connector - apart from the battery connector - pull up straight. It must be exactly at the of the beginning of the brown clip when pulled downwards.
MISC
I have successfully paired this phone with a PS3 controller using Sixaxis. This is not unique to my phone as I have verified that there is support within the Kernel for this.
It does seem that Wii controller support can be turned on according to the kernel...
There are no known custom kernels for this phone, however, the incomplete Cyanogenmod ROM available does seem to use its own kernel.
The phone is "stuck" on ICS 4.0.4 with almost every ROM. The incomplete Cyanogenmod ROM upgrades the OS to JB 4.1.2.
The phone is known to have heating issues on different (all?) firmware versions. While these do not seem to attribute to hardware failure, it is an annoyance.
Different firmware versions apparently produce varying levels of GPU performance: The best in GPU performance is U950V1.0.0B14, but this build may produce issues in some games. The worst in GPU performance is U950V1.0.0B18, but it is stable. The U950V1.0.0B22 is stable as well but has better GPU performance than B18. I have found no information on how well the first and last firmware versions perform in terms of GPU.
To disconnect the battery connector you need to place a spudger beneath and lift up. It is the same method used for the connectors of fans, temperature sensors, and the battery in a MacBook Pro 2006/7/8.
Thank you for this Tutorial.
Do you know a method to change language in CWM ?
Best regards
cmoegele said:
Thank you for this Tutorial.
Do you know a method to change language in CWM ?
Best regards
Click to expand...
Click to collapse
Unfortunately I haven't found anything that would suggest that you can. The best I could do is have one of my friends tell me what each section states, but that may be a long while from now.
The menus I have figured out and listed are the most necessary. The others are just icing I suppose.
Unable to switch it back on
Hi,
first of all, please excuse me if this is not exactly related to this post, but I see there is not much discussion around this device so I figured this would be an okayish place to ask.
I got my ZTE U950 just today, put my SIM and MicroSD cards in it, turned it on, all OK. I played with it for a while, changed the language into English, tried some apps, deleted lots of default installed Chinese apps (such as Baidu, QQ, Baidu maps, etc).
I run Debian on my machine, so this guide wasn't working for me. However, I tried to run Genotools on Wine and followed the first steps, but no pop-up showed in my phone and I decided that probably Wine wasn't forwarding the USB dev properly. The phone kept on working normally for a while, I even recieved a phone call.
Then I turned it off just to switch the SIM back to my old phone and, after that, I haven't been able to switch the ZTE back on again. At first I thought it'd be the battery running out (although it reported 50% left while it was on), but I've had it connected for about 30 minutes now and I still can't turn it on...
Do you guys know if there is something I can try?
Thanks a lot and excuse me again if I posted in the wrong place... (and if I have, could you please point out where should I post it?)
Bernat.
EDIT: Today I woke up, I pressed the power button and... surprise! It just worked!
No Popup on phone
Hello
I have tried to follow the steps as you have mentioned.
Root>2nd Button>Popup>ok
But nothing appeared on my phone.
Can you guide me what should I do.
I have USB debugging and Unknown Source checked but no popup appeared on my phone.
raoyasir said:
Hello
I have tried to follow the steps as you have mentioned.
Root>2nd Button>Popup>ok
But nothing appeared on my phone.
Can you guide me what should I do.
I have USB debugging and Unknown Source checked but no popup appeared on my phone.
Click to expand...
Click to collapse
Do you have the usb-drivers installed ? (doublechek in device manager for windows ) Sometimes Win7-64 or Firewalls block uncertified drivers to install correctly. For 7-64 you can press F8 during early boot and choose "force unsigned drivers" or something simiar. On linux you should go through an Android adb installation howto, to correctly get debuginterface running.
Once you have installed chinese recover you can install some prerooted images from the hungarion or chinese sites.
br
cm
PS: has someone skills for implementing other languages or removing the chinese letters on some menues ?
I just bought ZTE V985 which is also tegra 3 device. Can anyone help how to root it?
Sent from my HTC Desire using xda app-developers app
how to root zte v985
someone please tell us how to root zte v985.
3G
Hi guys,
does anybody know if/how it is possible to connect to a 3G network with this terminal? In the specs it says it can only connect to Chinese 3G networks, so I'd like to know whether this is a software or a hardware restriction.
If it's a hardware one, I guess the solution must be pretty complex...
Cheers!
alz_uk said:
someone please tell us how to root zte v985.
Click to expand...
Click to collapse
I was able to root my ZTE V985 couple days ago. Download root installation package from:
http://pan.baidu.com/share/link?shareid=68344&uk=2753639880
1. Install ZTE USB driver first: Goto Settings -Developer options - enable Driver CDROM. Connect your phone to the computer and install driver package from ZTE. 985root.7z package has also ZTE USB driver but it didn't work on my Win 7, so I installed drivers from phone.
2. Turn off CDROM mode and enable USB debugging mode and Unknown sources
3. Unzip 985root.7z file to any folder
4. Run xxxroot.bat and command window appears. Script will stop and ask you to press any key (in Chinese)
5. Check that your phone is connected and press any key. Script will upload files to your phone
6. There will be popup window on your phone. Click Restore my data
7. Phone will then boot up but keep it connected to PC and wait until it is fully booted
8. if there's nothing going on in command window, press any key and command window closes. If your are rooted, you have SuperUser app
Original instructions from here:
http://bbs.gfan.com/android-5226211-1-1.html
And Google translation:
http://translate.google.com/transla...=http://bbs.gfan.com/android-5226211-1-1.html
suunnittelija said:
I was able to root my ZTE V985 couple days ago. Download root installation package from:
http://pan.baidu.com/share/link?shareid=68344&uk=2753639880
1. Install ZTE USB driver first: Goto Settings -Developer options - enable Driver CDROM. Connect your phone to the computer and install driver package from ZTE. 985root.7z package has also ZTE USB driver but it didn't work on my Win 7, so I installed drivers from phone.
2. Turn off CDROM mode and enable USB debugging mode and Unknown sources
3. Unzip 985root.7z file to any folder
4. Run xxxroot.bat and command window appears. Script will stop and ask you to press any key (in Chinese)
5. Check that your phone is connected and press any key. Script will upload files to your phone
6. There will be popup window on your phone. Click Restore my data
7. Phone will then boot up but keep it connected to PC and wait until it is fully booted
8. if there's nothing going on in command window, press any key and command window closes. If your are rooted, you have SuperUser app
Original instructions from here:
http://bbs.gfan.com/android-5226211-1-1.html
And Google translation:
http://translate.google.com/transla...=http://bbs.gfan.com/android-5226211-1-1.html
Click to expand...
Click to collapse
Thank you very much my freind, you are a kind and intelligent person.
---------- Post added at 12:31 AM ---------- Previous post was at 12:27 AM ----------
nabax said:
Hi guys,
does anybody know if/how it is possible to connect to a 3G network with this terminal? In the specs it says it can only connect to Chinese 3G networks, so I'd like to know whether this is a software or a hardware restriction.
If it's a hardware one, I guess the solution must be pretty complex...
Cheers!
Click to expand...
Click to collapse
Hahaha you silly billy, i know whats happened to you! You got the ZTE U985 instead of the V985. The ZTE U985 only supports TD-SCDMA 3g network which is CHINA only. You should have bought the ZTE V985 which is WCDMA 800/1900/2100 mhz which supports western 3G networks. LMFAO. I feel sorry for you fella.
Where did you buy the v985 ? I only can find offers from 350-400$ and for this pricing I can´t find any real advantages buying a chinese phone , there is also no DualSim,and normally very limited languages ( chinese cwm?),....
cmoegele said:
Where did you buy the v985 ? I only can find offers from 350-400$ and for this pricing I can´t find any real advantages buying a chinese phone , there is also no DualSim,and normally very limited languages ( chinese cwm?),....
Click to expand...
Click to collapse
I bought it from fastcardtech.com, only 275 USD with free delivery.
From hardware specs point of view this is a really good phone, fast as my Asus TF700T tab with Tegra 3. It also supports WCDMA 900/2100MHz which are the most used 3G frequencies in EU. It does have only English and Chinese languages, but I used MoreLocale 2 to get more choices. More Locale does not change system language (like settings, caller app etc) so those will remain in English, but for example now other apps like Google play, Chrome etc. supports the language you have chosen in MoreLocale.
Sent from my ZTE V985 using xda app-developers app
cmoegele said:
Where did you buy the v985 ? I only can find offers from 350-400$ and for this pricing I can´t find any real advantages buying a chinese phone , there is also no DualSim,and normally very limited languages ( chinese cwm?),....
Click to expand...
Click to collapse
Dont get it wrong my mate the zte v985 is a beast of a phone + a smart piece of hardware. Only downfall i see is the limited rom/root/customization support since its new (october 2012)
Reasons why you should purchase the zte v985:
1. really supports APP2SD (install apps to external sd so you never run out of space and you dont have to throw away your phone when internal memory of 4GB gets full like most other android phones)
2. quad core cpu + 12 core NVIDIA gpu (theres websites full of games made only for this cpu + gpu)
3. USB OTG (using your superfast cpu and gpu together with usb otg you can turn your phone into an high class gaming system using two usb game controllers playing arcade roms and 3d games ON YOUR PHONE!). This is an awesome feature that not all phones support even some high performance quad core phones dont have this function.
4. 720P HD screen + 1080P HD Playback/Recording
5. Full MHL support (usb to hdmi)
6. Cheapest all round high performance quad core. Awesome price (£190) for a phone compared to other quad core high performance phones e.g galaxy note 2 @ £500
NOTE: if you would like to buy this phone for the price mentioned leave a message with your email or contact me i know a seller in china.
NOTE: Or you could wait another month or two and buy the new mtk 6589 quad core phones such as the UMI X2 which is quad core, DUAL SIM, usb otg, 2GB RAM, 32GB ROM and dirt cheap (£200!!!)
I get my ZTE V985 today through the post, cant wait till i get it!
Recovery in english language?
Hi
Anyone found Recovery in English language?
Google play
I can install google play, but if i open it, it immediatly shuts down again...
Any idea's ?
cwm zte u950 test 1 (build, 28 nov 2012) by me.
===================================
(cwm-u950-6.0.2.3-permanent)
-------------------------------------------
CRC32 : D2CD4005
MD5 : A1C6B72375B2E79100AA9BE52D0F30C2
SHA-1 : C7B3165D1E1F7463BFF16C0DE7747E6B3EC3F807
xxx.media*fire.com/download.php?0411sb2m1kkyrv4
(cwm-u950-6.0.2.3-temporary)
------------------------------------------
CRC32 : 830121A8
MD5 : 8239E70CB81548FE4427C505A5184749
SHA-1 : 9CF9CED3EC6CA2B79AE174E03A423435BB0FFFAC
xxx.media*fire.com/download.php?m90c896m17u0o9p
sorry.. i still need to learn..
please report cwm zte u950 test 1 (build, 28 nov 2012).
suunnittelija said:
I bought it from fastcardtech.com, only 275 USD with free delivery.
From hardware specs point of view this is a really good phone, fast as my Asus TF700T tab with Tegra 3. It also supports WCDMA 900/2100MHz which are the most used 3G frequencies in EU. It does have only English and Chinese languages, but I used MoreLocale 2 to get more choices. More Locale does not change system language (like settings, caller app etc) so those will remain in English, but for example now other apps like Google play, Chrome etc. supports the language you have chosen in MoreLocale.
Sent from my ZTE V985 using xda app-developers app
Click to expand...
Click to collapse
ZTE Grand Era V985 Recovery (support English)download link: pan.baidu.com/share/link?shareid=372147&uk=973327405
If you have any problems,please sent a email to me ,my email address is '[email protected]' ,i can help root your ZTE Grand Era V985,and install the recovery,the recovery includes English language.At last,the Android 4.2 for V985 will coming soon,maybe in April,if anyone need ,i will send to you.Thank you.
i found twrp for the zte u950 in english in this package, it is in the folder recovery_3 :good:
what do you think? is it possible to make the zt3 u980 to work with european 3g network? i thought to flash the baseband from zte v985 on the zte u950... do you think its possible?
More stuff in English
hey Heatshiver...u can add these in your OP
I found some roms HERE for U950 which support english language..and atleast instructions are in english
2 or 3 of them are based on MIUI ...
I've tried the 1st one...works perfectly so didn't flash others
Extracted img file of twrp recovery (english) from the package provided by superpfpf - attached in the post
Ok so I have a problem, I would think most users have this too: The max volume level being too low. So I went ahead to search google for help, and downloaded "Ultra volume mod" now what I'm supposed to do is to overwrite the "default_gain.config" but when I do, it says permission denied. So I tried another method, manually editing the code. Now it justs says that an error occured when I try to save it. I did a little digging on the internet, and found out that my system is apparently read-only, how do I change that? Oh yeah, I'm currently using ES File Explorer, most people said theres a button to mount something but I can't find the button, maybe thats the fix to it? I have the latest updated version of the root explorer and I still cant find the mount button.
Well, while you're here can you help me with another one? On game hacking apps such as GameCIH or GameGuardian, either right after I grant root permission, it says "error: root denied" or it says nothing and when I try to change the code, nothing happens. Thanks for helping.
Device: Samsung Galaxy Note II GT-17005
Root: Yes
OS: Android Jellybean 4.3, Stock.
Any other info thats needed? Please say so, I will do my best to provide them. And please don't post complicated stuff, the most I can do is read simple codes and edit them, such as the volume one. I cant decode, read complex codes or create codes, if theres anything complicated, please try your best to explain how to do it. Thank you in advance for your help.
Portalception said:
Ok so I have a problem, I would think most users have this too: The max volume level being too low. So I went ahead to search google for help, and downloaded "Ultra volume mod" now what I'm supposed to do is to overwrite the "default_gain.config" but when I do, it says permission denied. So I tried another method, manually editing the code. Now it justs says that an error occured when I try to save it. I did a little digging on the internet, and found out that my system is apparently read-only, how do I change that? Oh yeah, I'm currently using ES File Explorer, most people said theres a button to mount something but I can't find the button, maybe thats the fix to it? I have the latest updated version of the root explorer and I still cant find the mount button.
Well, while you're here can you help me with another one? On game hacking apps such as GameCIH or GameGuardian, either right after I grant root permission, it says "error: root denied" or it says nothing and when I try to change the code, nothing happens. Thanks for helping.
Device: Samsung Galaxy Note II GT-17005
Root: Yes
OS: Android Jellybean 4.3, Stock.
Any other info thats needed? Please say so, I will do my best to provide them. And please don't post complicated stuff, the most I can do is read simple codes and edit them, such as the volume one. I cant decode, read complex codes or create codes, if theres anything complicated, please try your best to explain how to do it. Thank you in advance for your help.
Click to expand...
Click to collapse
Open ES file explorer hit menu button ,scroll down, check mark root explorer ,slider will turn blue,then click extreme left of root explorer you'll get a pop up with few options,click on Mount R/W then another pop up comes up and you'll see RO and RW columns,and 4 rows of options.Select the RW column for each of the row options.That would mount your system to read and write files just like you are doing right now.Once you change your default_gain.conf it will ask you to replace it with existing one (you should make a back up of your original one on the sd card) then replace it,long press on the new file click on MORE at the bottom right then Properties then you'll see permissions as RWX-RWX-RWX- and Change next to it.click on change and you'll see 3 rows and 3 columns make it read as RW-R-R basically selecting first 2 columns for first option and only the first option for 2nd and 3rd row.Click ok,exit the es file explorer and reboot your phone. I am attaching images below so you can get visual help as well (my options differ a bit under es file explorer since im not running TW ROM but concept is same
Note: Root is must (I see you've mentioned you are rooted)
Thank you so much for the help, it worked perfectly, now my volume is just as its supposed to be. Thank you for your help, now i just need someone to answer my second question.
2nd one sounds like an app issue now you have confirmed it's not a root issue. Probably don't work on 4.3. Think I remember seeing groans from game cheaters about apps not being supported.
Oh okay... well, i tried out the mod, forgot that 1db more is 3 times a loud as the bd before. Almost busted my cheapass earphones. Also the static noise you hear in idk, clash of clans during start up increased by at least 5 times. Switching back, luckily i took your advice on making a backup.Thanks guys, really helped me. In the shortest time of any other forum too.
Portalception said:
Oh okay... well, i tried out the mod, forgot that 1db more is 3 times a loud as the bd before. Almost busted my cheapass earphones. Also the static noise you hear in idk, clash of clans during start up increased by at least 5 times. Switching back, luckily i took your advice on making a backup.Thanks guys, really helped me. In the shortest time of any other forum too.
Click to expand...
Click to collapse
Ya many of us eat , breathe and sleep on xda and love to help out people cause we were also once in your shoes so I know how it feels when something doesn't work right ,the anxiety levels sky rocket at once and panick sets in.
Edit: You might want to quote people when responding to someone in particular so he/she gets notified otherwise they might not check back on the thread and your future questions might be left unanswered.Just a suggestion
Well if its just thanks i think they would like it if they didnt get spammed on email. Anyway i fixed the static problem, seems like the old speakerboost app i tried but did not delete was jealous of the mod, uninstalled and mod works like a charm.
I was posting some questions in the "Rooted Jeep Cherokee '14 Uconnect" thread but I've started this new thread for the 17.xx versions because the methods (if we are able to identify them) aren't the same as the 16.33.29 and earlier firmwares...
I am still trying to crack into that unit with the 17.11.07 software. I have a D-Link USB Ethernet but its a HW revision D and I believe I would need a B if we can get ethernet enabled at all.
Also, if we can get Ethernet enabled we will still need to get SSH password or key.
devmihkel said:
For good or for bad NOT everything appears correct, except the running 17.x version... As of now neither the "commercial jailbreak" supports new versions (well yes they were using exactly the same file to start with Also 16.51.x or newer appears to be no go: uconnect-8-4-8-4an-update
EDIT: haven't got 17.09.07 to try, but on 17.11.07 manifest.lua has changed and the last block/ search keyword is "ota_update" instead. Otherwise all the same, image valid after the edit and script.sh gets fired - at least on 16.33.29 that is @HanJ67 Did you actually try to mount installer.iso after the edit and checked /etc/manifest.lua for the end result before?
Click to expand...
Click to collapse
devmihkel said:
Yeah, 2nd attempt is much better as last lua block is correctly terminated and your script might actually run, but unfortunately no successful 17.x runs have been reported so far SWF scripts are not involved in update/jail-breaking run, these ones become relevant only once you are in (and need to enable some app or wifi or navi features etc). Afaik 17.x blocks ethernet dongle usage as well, but let's see if even the USB driver/link gets activated at all?
Click to expand...
Click to collapse
Do you have a 16.33.29 version I can try this on? I'm wondering if it will get me far enough to execute the "manifest.lua HD_Update" hack you and @HanJ67 were discussing.
I've used the 17.43.01, then finally found a 17.11.07 and had no luck there either.
In my latest attempts on the 17.11.07, I was able to hex edit the "ifs-cmc.bin" on the UPD and replaced the SSH-RSA key with my own. I think this bin will be flashed to the MMC during an update.
That SWDL.UPD got past the initial check and rebooted into update mode, but then it fails the second ISO check and loops. I had to use an unmodified image to finish the update and get back up and running.
I keep reading about making changes only after the 2048 Byte mark in the older versions with the "S" at 0x80. Is this still relevant
in later ISO/UPD images and to the second ISO check?
Right now, I'm looking to find a way to disable that check so that my modified .bin will be written to disk? I think this route would work to also modifying and getting WiFi enabled after a flash of the edited image.
If I had I 16.33.29 or similar older UPD version to attempt the HD_UPDATE hack in the Manifest.lua file I would give that a shot to be thorough.
Do You have an idea how to connect by USB2LAN adapter to uConnect ?
Do You know if there is an UART pins on the mainboard ?
itsJRod said:
I was posting some questions in the "Rooted Jeep Cherokee '14 Uconnect" thread but I've started this new thread for the 17.xx versions because the methods (if we are able to identify them) aren't the same as the 16.33.29 and earlier firmwares...
I am still trying to crack into that unit with the 17.11.07 software. I have a D-Link USB Ethernet but its a HW revision D and I believe I would need a B if we can get ethernet enabled at all.
Also, if we can get Ethernet enabled we will still need to get SSH password or key.
Do you have a 16.33.29 version I can try this on? I'm wondering if it will get me far enough to execute the "manifest.lua HD_Update" hack you and @HanJ67 were discussing.
I've used the 17.43.01, then finally found a 17.11.07 and had no luck there either.
In my latest attempts on the 17.11.07, I was able to hex edit the "ifs-cmc.bin" on the UPD and replaced the SSH-RSA key with my own. I think this bin will be flashed to the MMC during an update.
That SWDL.UPD got past the initial check and rebooted into update mode, but then it fails the second ISO check and loops. I had to use an unmodified image to finish the update and get back up and running.
I keep reading about making changes only after the 2048 Byte mark in the older versions with the "S" at 0x80. Is this still relevant
in later ISO/UPD images and to the second ISO check?
Right now, I'm looking to find a way to disable that check so that my modified .bin will be written to disk? I think this route would work to also modifying and getting WiFi enabled after a flash of the edited image.
If I had I 16.33.29 or similar older UPD version to attempt the HD_UPDATE hack in the Manifest.lua file I would give that a shot to be thorough.
Click to expand...
Click to collapse
Hello, any news about it?
hi,
can you explain how to change SSH key in "ifs-cmc.bin" file?
thanks a lot
itsJRod said:
I was posting some questions in the "Rooted Jeep Cherokee '14 Uconnect" thread but I've started this new thread for the 17.xx versions because the methods (if we are able to identify them) aren't the same as the 16.33.29 and earlier firmwares...
I am still trying to crack into that unit with the 17.11.07 software. I have a D-Link USB Ethernet but its a HW revision D and I believe I would need a B if we can get ethernet enabled at all.
Also, if we can get Ethernet enabled we will still need to get SSH password or key.
Do you have a 16.33.29 version I can try this on? I'm wondering if it will get me far enough to execute the "manifest.lua HD_Update" hack you and @HanJ67 were discussing.
I've used the 17.43.01, then finally found a 17.11.07 and had no luck there either.
In my latest attempts on the 17.11.07, I was able to hex edit the "ifs-cmc.bin" on the UPD and replaced the SSH-RSA key with my own. I think this bin will be flashed to the MMC during an update.
That SWDL.UPD got past the initial check and rebooted into update mode, but then it fails the second ISO check and loops. I had to use an unmodified image to finish the update and get back up and running.
I keep reading about making changes only after the 2048 Byte mark in the older versions with the "S" at 0x80. Is this still relevant
in later ISO/UPD images and to the second ISO check?
Right now, I'm looking to find a way to disable that check so that my modified .bin will be written to disk? I think this route would work to also modifying and getting WiFi enabled after a flash of the edited image.
If I had I 16.33.29 or similar older UPD version to attempt the HD_UPDATE hack in the Manifest.lua file I would give that a shot to be thorough.
Click to expand...
Click to collapse
sofro1988 said:
Hello, any news about it?
Click to expand...
Click to collapse
I have not had had much time to work on this.
I actually had an idea last week that brought me back to this. I plan to use a custom flash drive to present an unmodified ISO for verification, then swap nand to an identical image that has been he's edited to enable usb Ethernet and add a custom key for ssh access.
I thought to stack a NAND on top of the original on a is flash drive, then breakout the Chip Enable pin to a switch. I've seen this done for with guys modifying game consoles to be able to run modified firmware.
Once the 2nd NAND is in place I will restore an image of the original nand containing the unmodified update, then hex edit the required portions to allow access after updating.
If this method works, I should be able to pass the verification with the original nand chip, then switch it (hopefully there's a big enough window to do this by hand) then present the modified nand before it begins the flash procedure.
Hopefully someone more intimately familiar with the update scripts can verify I'm not missing anything in the process
Tajadela said:
hi,
can you explain how to change SSH key in "ifs-cmc.bin" file?
thanks a lot
Click to expand...
Click to collapse
I used a hex editor to find the Ssh RSA key and replace it. This passed the initial check to reboot into update mode, but wouldn't pass the full check in update mode. I'm hoping my attempt below will pass that check and still update with the modifications.
itsJRod said:
I used a hex editor to find the Ssh RSA key and replace it. This passed the initial check to reboot into update mode, but wouldn't pass the full check in update mode. I'm hoping my attempt below will pass that check and still update with the modifications.
Click to expand...
Click to collapse
thanks for answer.
I saw an ssh key with the hex editor, but I would like to see exactly what you have replaced.
if it's not too much trouble, it would be interesting to see with some screenshots the changes you've made.
So we could work on two fronts. The idea of the double nand is good, but not very simple to make ...
Just thinking out loud here, when you say it passes the initial check, does it then give you any confirmation of that or any message on the screen before rebooting to upgrade mode?
Sent from my CLT-L09 using Tapatalk
SquithyX said:
Just thinking out loud here, when you say it passes the initial check, does it then give you any confirmation of that or any message on the screen before rebooting to upgrade mode?
Sent from my CLT-L09 using Tapatalk
Click to expand...
Click to collapse
I tried much the same thing -- the swdl.upd is another CDROM filesystem:
martinb$ file swdl.upd
swdl.upd: ISO 9660 CD-ROM filesystem data 'CDROM'
It contains three more .iso files : installer.iso, primary.iso, and secondary.iso
installer.iso is a CDROM image, but is not mountable on my linux system
primary.iso is a CDROM image, and has the usual /bin, /etc/, and /usr filesystem for an install
the /bin directory has one file - update_nand
the /etc directory has the usual mfgVersiontxt, nand_partion.txt, system_etfs_postinstall.txt, system_mmc_postinstall.txt and version.txt
the /usr/share directory is all the firmware for various components - EQ, HD_FIRMWARE, IFS, MMC_IFS_EXTENSION,OTA,SIERRA_WIRELESS,V850, and XM_FIRMWARE
What's interesting to me is that they did update the SIERRA_WIRELESS firmware -- and have done some housecleaning:
Code:
#---------------------------------
# sierra_wireless_disable_flowcontrol.file
# \d == 1 second delay
SAY " Send AT \n"
'' AT\r
OK \d
SAY "Disable flow control\n"
'' at+ifc=0,0\r
OK \d
SAY "Send SMS command CNMI\n"
'' at+cnmi=2,1,0,1,0\r
OK \d
SAY "Clear emergency number list\n"
'' AT!NVENUM=0\r
OK \d
SAY "Set emergency number to 911\n"
'' AT!NVENUM=1,"911"\r
OK \d
SAY "Save Setting\n"
'' at&w\r
OK \d
#---------------------------------
Also in the IFS directory, when you hexedit the ifs-cmc.bin file it reveals another little treat... an SSH root public key ( not as nice as a private key, but hey )
(Sorry about the formatting, this is cut/paste right out of the hex editor)
Code:
ssh-rsa [email protected]
2E..IwU.Q....njle8r9nrJ7h8atg4WfqswU0C0Rk/Ezs/sQs5ZA6ES82MQONjHBd7mw
uo8h0xfj3KeeSHMXCEBpmU26guNE4EqfvdioLFCDUxtvMYswlUZjsvd/NYz9lnUZg2hy
pwzFQjXgSzmHVrHjkKKvq7Rak/85vGZrJKxlvHnowA8JIl1tVNVQjPMNgDDJabaETtfw
LL1KlvAzI81cKOG/3IRn9lU6qyYqyG+zYoza0nN\..7/AtxdL481k81Go5c3NQTnkl2U
68lbu8CpnwrYCU098owLmxdI4kF5UOL4R61ItJuwz30JSESgT..!8RDgM6XEiHUpK9yW
vvRg+vbGWT/oQn0GQ== [email protected]
in /usr/share/MMC_IFS_EXTENSION/bin/cisco.sh and dlink.sh there's another good hint - what adapter you need for USB ethernet
Code:
#!/bin/sh
# Handle an Ethernet connection via the CISCO Linksys USB300M adapter
or
Code:
#!/bin/sh
# Handle an Ethernet connection via the D-Link DUB-E100 adapter
The static IP it brings up if no DHCP is offered is : 192.168.6.1
There's tons more in there -- like the V850 chip has access to the Sierra Wireless CDMA modem, but can configure it for voice calls through the car speakers:
"AT!AVSETPROFILE=8,1,1,0,5" ( embedded in the cmcioc.bin update file )
secondary.iso is a CDROM image and only has /etc/ and /usr
the /etc/ directory has speech_mmc_preinstall.txt and xlets_mmc1_preinstall.txt
the /usr/ directory has /usr/share/speech and /usr/share/xlets ( tons of information about sensors in the car, etc in xlets )
martinbogo1 said:
I tried much the same thing -- the swdl.upd is another CDROM filesystem:
martinb$ file swdl.upd
swdl.upd: ISO 9660 CD-ROM filesystem data 'CDROM'
It contains three more .iso files : installer.iso, primary.iso, and secondary.iso
installer.iso is a CDROM image, but is not mountable on my linux system
primary.iso is a CDROM image, and has the usual /bin, /etc/, and /usr filesystem for an install
the /bin directory has one file - update_nand
the /etc directory has the usual mfgVersiontxt, nand_partion.txt, system_etfs_postinstall.txt, system_mmc_postinstall.txt and version.txt
the /usr/share directory is all the firmware for various components - EQ, HD_FIRMWARE, IFS, MMC_IFS_EXTENSION,OTA,SIERRA_WIRELESS,V850, and XM_FIRMWARE
What's interesting to me is that they did update the SIERRA_WIRELESS firmware -- and have done some housecleaning:
Code:
#---------------------------------
# sierra_wireless_disable_flowcontrol.file
# \d == 1 second delay
SAY " Send AT \n"
'' AT\r
OK \d
SAY "Disable flow control\n"
'' at+ifc=0,0\r
OK \d
SAY "Send SMS command CNMI\n"
'' at+cnmi=2,1,0,1,0\r
OK \d
SAY "Clear emergency number list\n"
'' AT!NVENUM=0\r
OK \d
SAY "Set emergency number to 911\n"
'' AT!NVENUM=1,"911"\r
OK \d
SAY "Save Setting\n"
'' at&w\r
OK \d
#---------------------------------
Also in the IFS directory, when you hexedit the ifs-cmc.bin file it reveals another little treat... an SSH root public key ( not as nice as a private key, but hey )
(Sorry about the formatting, this is cut/paste right out of the hex editor)
Code:
ssh-rsa [email protected]
2E..IwU.Q....njle8r9nrJ7h8atg4WfqswU0C0Rk/Ezs/sQs5ZA6ES82MQONjHBd7mw
uo8h0xfj3KeeSHMXCEBpmU26guNE4EqfvdioLFCDUxtvMYswlUZjsvd/NYz9lnUZg2hy
pwzFQjXgSzmHVrHjkKKvq7Rak/85vGZrJKxlvHnowA8JIl1tVNVQjPMNgDDJabaETtfw
LL1KlvAzI81cKOG/3IRn9lU6qyYqyG+zYoza0nN\..7/AtxdL481k81Go5c3NQTnkl2U
68lbu8CpnwrYCU098owLmxdI4kF5UOL4R61ItJuwz30JSESgT..!8RDgM6XEiHUpK9yW
vvRg+vbGWT/oQn0GQ== [email protected]
in /usr/share/MMC_IFS_EXTENSION/bin/cisco.sh and dlink.sh there's another good hint - what adapter you need for USB ethernet
Code:
#!/bin/sh
# Handle an Ethernet connection via the CISCO Linksys USB300M adapter
or
Code:
#!/bin/sh
# Handle an Ethernet connection via the D-Link DUB-E100 adapter
The static IP it brings up if no DHCP is offered is : 192.168.6.1
There's tons more in there -- like the V850 chip has access to the Sierra Wireless CDMA modem, but can configure it for voice calls through the car speakers:
"AT!AVSETPROFILE=8,1,1,0,5" ( embedded in the cmcioc.bin update file )
secondary.iso is a CDROM image and only has /etc/ and /usr
the /etc/ directory has speech_mmc_preinstall.txt and xlets_mmc1_preinstall.txt
the /usr/ directory has /usr/share/speech and /usr/share/xlets ( tons of information about sensors in the car, etc in xlets )
Click to expand...
Click to collapse
Have you tried connecting to it?
Sent from my iPhone using Tapatalk
sofro1988 said:
Have you tried connecting to it?
Sent from my iPhone using Tapatalk
Click to expand...
Click to collapse
I managed to connect with the cisco adapter (usb / ethernet), but I don't know the root password. is the problem at the moment insurmountable ..
Using a cisco connector, I have gotten the ethernet to come up, but that's it. At the moment, there doesn't seem to be anything I can connect to.
@Tajadela - sounds like you at least were able to either SSH or telnet in to a port... I'm on software version 17.43.01 .. which are you on, and what year vehicle? ( Jeep Grand Cherokee, 2015, Uconnect 8.4AN with the 3G Sierra Aircard modem for Sprint )
martinbogo1 said:
Using a cisco connector, I have gotten the ethernet to come up, but that's it. At the moment, there doesn't seem to be anything I can connect to.
@Tajadela - sounds like you at least were able to either SSH or telnet in to a port... I'm on software version 17.43.01 .. which are you on, and what year vehicle? ( Jeep Grand Cherokee, 2015, Uconnect 8.4AN with the 3G Sierra Aircard modem for Sprint )
Click to expand...
Click to collapse
I connected in telnet on a uconnect 6.5 with firmware 15.xx.xx. You can connect to Uconnect with static IP it brings up if no DHCP is offered is: 192.168.6.1
itsJRod said:
I used a hex editor to find the Ssh RSA key and replace it. This passed the initial check to reboot into update mode, but wouldn't pass the full check in update mode. I'm hoping my attempt below will pass that check and still update with the modifications.
Click to expand...
Click to collapse
after rsa key replaced, do you have recalculate the checksum of UPD file?
have you replaced the first 64 bytes of the file?
thanks
@itsJRod, isn't it that you would like to explain the procedure to replace the RSA key in the swdl file? thank you
Hello,
have you made any progress? I am a bit lost. I put the EU uconnect MY15 to US dodge charger MY16 and Perf Pages were working fine even on 16.16.13, although after upgrade to 17.x (17.46.0.1 right now) I am meeting the problem of expired subscription (which is not possible to have on EU radio).
I am considering basically three solutions:
a) going back to US radio, but modify the language pack/nav/FM frequencies (it is doable, but I do not know how, although I can pay for it relatively less than time invested)
b) downgrade to 16.16.13 - I have no clue how to do it, I tried to put swdl.upd with swdl.iso as and installer.iso with no luck of course.
c) take xlets from KIM2/ of 16.16.13 to KIM23 of 17.46.0.1 secondary.iso - this is probably preferred way but I do not know how to make it to pass ISO validation.
Of course root on uconnect is extremely nice to have but I will be fully satisfied with Perf Pages working again.
Hello.
I'm hoping the community can help me out. I have a RAM 1500 with the RA4 (was running the 17.11.07 software that I got pushed to me OTS style a couple years ago. Since them problems, radio turn on delay, no GPS and cellular phone warning popup.
I was told to do the 18.45 update which I got from driveuconnect.com, but this has essentially bricked my radio with the "bolo update failed" error and it is looping continuously
I have tried many ways to modify the update software's manifest.lua script to try to get rid of the sierra wireless portion by manually editing, hex editing, etc but always get the "please insert the USB card" screen.
Uconnect is obviously completely worthless to help me and the dealer wants me to pay them money to tell me what I already know. I know I can pay 300 and send my radio to infotainemnt.com to get it repaired, but I would like to solve this on my own is possible, because I would like to further modify the software to make it more custom and unique.
From my reading the 17x version keeps you from downgrading to a version that can be hacked easily.
Everything seems like it should be pretty straight forward as I have a lot of experience in programming and embedded devices.
It seems they are validating the ISOs using some mechanism, I believe I have tried all of tricks/methods
I have searched the code to see if I can find the iso MD5 or SHA256 hashes that ioc_check is probably using to figure out I changed somethign but nothing work.
I have even tried the swapping the flash drives after validation but it seems they are using the ISos they already copied to continue the process, I then end u getting some invalid errors or the update just crashes out
I got other updates from the link: http://www.mydrive.ch/
http://www.mydrive.ch/http://www.mydrive.ch/
username: [email protected]
Password: gasolio
Havent tried all of them yet, but pretty sure they wont work, due to the 17x security changes.
Any help would be appreciated grealty, I really dont want to shell out any cash for something a company told me to to and due to their screw up with bricking modems, this is now bricking my radio.
Thanks to all in advance !!!
djmjr77 said:
Hello.
I'm hoping the community can help me out. I have a RAM 1500 with the RA4 (was running the 17.11.07 software that I got pushed to me OTS style a couple years ago. Since them problems, radio turn on delay, no GPS and cellular phone warning popup.
I was told to do the 18.45 update which I got from driveuconnect.com, but this has essentially bricked my radio with the "bolo update failed" error and it is looping continuously
I have tried many ways to modify the update software's manifest.lua script to try to get rid of the sierra wireless portion by manually editing, hex editing, etc but always get the "please insert the USB card" screen.
Uconnect is obviously completely worthless to help me and the dealer wants me to pay them money to tell me what I already know. I know I can pay 300 and send my radio to infotainemnt.com to get it repaired, but I would like to solve this on my own is possible, because I would like to further modify the software to make it more custom and unique.
From my reading the 17x version keeps you from downgrading to a version that can be hacked easily.
Everything seems like it should be pretty straight forward as I have a lot of experience in programming and embedded devices.
It seems they are validating the ISOs using some mechanism, I believe I have tried all of tricks/methods
I have searched the code to see if I can find the iso MD5 or SHA256 hashes that ioc_check is probably using to figure out I changed somethign but nothing work.
I have even tried the swapping the flash drives after validation but it seems they are using the ISos they already copied to continue the process, I then end u getting some invalid errors or the update just crashes out
I got other updates from the link: http://www.mydrive.ch/
http://www.mydrive.ch/http://www.mydrive.ch/
username: [email protected]
Password: gasolio
Havent tried all of them yet, but pretty sure they wont work, due to the 17x security changes.
Any help would be appreciated grealty, I really dont want to shell out any cash for something a company told me to to and due to their screw up with bricking modems, this is now bricking my radio.
Thanks to all in advance !!!
Click to expand...
Click to collapse
Just to follow up for anyone who reads this in the future.
I was able to get my uconnect working again a few minutes ago.
As my previous post stated I got stuck in the "bolo update failed" loop.
I downloaded the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in my previous comment.
I did the S Byte HEX Mod to the swdl.iso file, loaded it and the swdl.upd file on a thumb drive. Used Hxd on windows. Followed the section in the Uconnect exploitation PDF:
https://www.google.com/url?sa=t&source=web&rct=j&url=http://illmatics.com/Remote%2520Car%2520Hacking.pdf&ved=2ahUKEwjZsOGNl5nyAhWhGVkFHZy2AnAQFnoECAcQAg&usg=AOvVaw0NAi3a1eh-IRd3n1VHv-ys
When I plugged it in, it started with the update process, after the first unit, the screen said the Uconnect had to restart, please wait..
And whalaa my radio worked again!!! It even says it has the 18.45 firmware on it.. go figure.. Navigation still does not work, but thats most likely because the sierra wireless card is bad.
I cannot say for sure the S Byte thing did anything, because I'm not messing with this anymore, almost had to buy a new radio.
I would say try it with out, then with it if it doesn't work.
This could also be a fluke with my particular unit, but at least its something else to try than pay 600+ dollars!!
Good luck to anyone else who goes through this mess!!!
djmjr77 said:
Just to follow up for anyone who reads this in the future.
I was able to get my uconnect working again a few minutes ago.
As my previous post stated I got stuck in the "bolo update failed" loop.
I downloaded the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in my previous comment.
I did the S Byte HEX Mod to the swdl.iso file, loaded it and the swdl.upd file on a thumb drive. Used Hxd on windows. Followed the section in the Uconnect exploitation PDF:
https://www.google.com/url?sa=t&source=web&rct=j&url=http://illmatics.com/Remote%2520Car%2520Hacking.pdf&ved=2ahUKEwjZsOGNl5nyAhWhGVkFHZy2AnAQFnoECAcQAg&usg=AOvVaw0NAi3a1eh-IRd3n1VHv-ys
When I plugged it in, it started with the update process, after the first unit, the screen said the Uconnect had to restart, please wait..
And whalaa my radio worked again!!! It even says it has the 18.45 firmware on it.. go figure.. Navigation still does not work, but thats most likely because the sierra wireless card is bad.
I cannot say for sure the S Byte thing did anything, because I'm not messing with this anymore, almost had to buy a new radio.
I would say try it with out, then with it if it doesn't work.
This could also be a fluke with my particular unit, but at least its something else to try than pay 600+ dollars!!
Good luck to anyone else who goes through this mess!!!
Click to expand...
Click to collapse
I created an account just to reply to this and All I have to say is you're literally an absolute life saver. I've been working on this every day for two weeks now, trying every trick people said, trying every USB, every format, every version and nothing ever worked from me. Uconnect support was absolutely no help and it was a lot of back-and-forth finger pointing and no you need to reach out to this person between them and the dealership. Dealership tried to charge me for a Proxy Alignment when I asked to just update my damn radio stuck in this loop.
I have a 2015 Jeep Cherokee 8.4AN VP4 NA Head Unit 68238619AJ. I was updating from 17.11.07 to 18.45.01 and got stuck at the step 11 1% and would get a failed sierra wireless every time and then got in that "bolo update failed" loop..Well to fix it just now all I did was download the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in the previous comment and quick format to FAT32 on a 16GB Micro Center USB extracted the files from 16.33.29 to the USB with 7ZIP, plugged in like normal and BOOM it ran the first step restarted and I had a working radio again showing update 18.45.01.
(So i'm assuming you don't have to do the S Byte thing I didn't even mess with it I just used the 16.33.29 to bypass step 11 since that version only has 14 steps and 18.45.01 was already preloaded from attempting before. My navigation still is the wrong address but I don't care about all that just thankful to have my radio back before my wife killed me for trying to update it by myself. )
I hope this helps someone else one day because it took some deep research and hours on hours of forum hoping to finally find the solution. <3
djmjr77 said:
Just to follow up for anyone who reads this in the future.
I was able to get my uconnect working again a few minutes ago.
As my previous post stated I got stuck in the "bolo update failed" loop.
I downloaded the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in my previous comment.
I did the S Byte HEX Mod to the swdl.iso file, loaded it and the swdl.upd file on a thumb drive. Used Hxd on windows. Followed the section in the Uconnect exploitation PDF:
https://www.google.com/url?sa=t&source=web&rct=j&url=http://illmatics.com/Remote%2520Car%2520Hacking.pdf&ved=2ahUKEwjZsOGNl5nyAhWhGVkFHZy2AnAQFnoECAcQAg&usg=AOvVaw0NAi3a1eh-IRd3n1VHv-ys
When I plugged it in, it started with the update process, after the first unit, the screen said the Uconnect had to restart, please wait..
And whalaa my radio worked again!!! It even says it has the 18.45 firmware on it.. go figure.. Navigation still does not work, but thats most likely because the sierra wireless card is bad.
I cannot say for sure the S Byte thing did anything, because I'm not messing with this anymore, almost had to buy a new radio.
I would say try it with out, then with it if it doesn't work.
This could also be a fluke with my particular unit, but at least its something else to try than pay 600+ dollars!!
Good luck to anyone else who goes through this mess!!!
Click to expand...
Click to collapse
Do you have another link to download the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe files? I am trying to help a friend of mine they way this helped me. Thank you again for this!