| Author |
SE d750/k750i/w800i flash guidelines for independent daredevils |
jockyw2001
Joined: Oct 29, 2005
Posts: 80 |  Posted: 2005-11-08 16:54
I hate it to be
dependent on external solution providers and hate to pay again and
again when it can be done for free in the first place. Updating SE
phone firmwares turned out to be a big pain in the ass when it turned
out that my k700i and k750i both couldn't be updated via the free SEUS.
I spent a lot of time trying to find free alternatives and consistent
information but instead found myself mostly in smoke curtains. Support
forums seem to be dominated, supported and moderated by commercial
solution providers. In the end I decided to update my phones via
DaVinciTeam and yes that worked out quite well and it wasn't that
expensive (10$ each). The k700i is doing fine, but the k750i which I
converted to a w800i with R1N035 firmware is causing trouble. The
R1N035 is buggy so I'd like to flash it with an older firmware, but I
don't like to pay again and again when there is a new firmware out
there. So I spent some more time and eventually found out that I have
maximum flexibility with a Cruiser 4-in-1 cable set (still 25$ !) and
several proggies I found in the Net. The Cruiser k750i adapter cable
needs an external voltage of 3V (I use 2 AA batteries).
I believe there are many SE users out there in a similar position,
and so I decide to share some of my knowhow and experience with you.
You will still need to search the Net for the proggies I describe
below. Oh I don't think this post will harm the phone flash business
whatsoever, majority of users will spend a few bugs so that they don't
have to think and get the support they payed for ...
Some knowhow and information
----------------------------------------------
There may be much better descriptions and explanations, the info
below is my interpretation of things and was good enough for me.
A SE phone has different IDs and properties. Here are some important ones you should be aware of:
* IMEI (international mobile equipment identifier): the first 6
digits (TAC) identify the model (e.g. k750i) and this is checked by
SEUS. I haven't identified a "free" tool where I can change it with,
neither do I know where it is stored.
* phone "color": RED (retail) and BROWN (developer).
* CID number: e.g. CID29 or CID36. The color and CID are stored in the phone's certificate afaik
* CDA number: identifies the firmware version e.g. CDA102371/11 for
k750i Western Europe Region 3 (en/ger/dut/dan/). This is also checked
by SEUS.
If IMEI doesn't correspond with CDA then SEUS refuses. SEUS also
refuses to update certain IMEI numberblocks and also various CDA
firmware versions. E.g. branded firmwares for which there isn't a later
version. SEUS is a set of java applets (java app which runs in browser
window) and servlets (which run on SEUS server). It should be possible
to hack the applet which checks the IMEI by feeding a 'valid' IMEI
and/or by 'feeding' another CDA string. I started playing around with
this with JDK appletviewer and jdb. Feel free to contact me if you are
a good java hacker. Could be a nice "clean" and cheap (no special
cables required) solution for keeping your phone up2date 
Firmware files consist of a "main" part, and a "fs" (filesystem
with various language) part. These files are usually encrypted so that
they only work with a single tool for which you have a credit. E.g.
DaVinciTeam files are packed and encrypted and have extension .DVT and
Sonics files are unpacked but encrypted and have extension .SNX.
Unencrypted files are aused by pbbse50 and pbb6 and by several other
setools and semc_tools versions. A decoder is available to decrypt and
unpack DVT files is available somewhere in the net. That tool is not
interesting for me since I flash with DaVinci (older version) and
complete with Sonics 1.1.2.0 (hacked version). It would be nice to have
a DVT encoder instead, since I found a couple of firmwares which are
unencrypted and not available on DVT server. Would be nice to generate
your own DVT files
----------------
EDIT1: Fallout, the author of the DVT decrypter tool, informed me
that a DVT encoder is not necessary since DVT also supports flashing
unencrypted files
----------------
Furthermore there is the GDFS area which contains various settings
for your phone. And then there is an area called EROM which seems to be
indispensible for a SE phone to boot up. If your phone is "dead"
usually you will have to flash an EROM file called K750_EROM.DVT
(DaVinciTeam). "Dead" means the phone doesn't power on and if you
connect DCU-60 datacable nothing happens either. The phone is still
flashable tho.
.DVT files can be downloaded either with the clients 13.7 and 13.8 (see below) or with anonymous ftp from 64.92.166.206
-------------------------------------------------------
EDIT6: courtesy 'mb-new'
What is Finalization/Customization/Complete procedure
----------------------------------------------------
It's nothing more than first default configuring of the phone after flashing FS file. Usually the process is:
1. Writing customize.xml and server&java certificates in
tpa/preset/custom in sonics folder to tpa/presest/custom folder in the
phone's internal file system
2. When the phone starts after flashing, it parses that xml file,
puts settings written in that xml into the phone's gdfs and works out
certificates (some go to Trusted certificates, some got Java
certificate etc)
If you open customize.xml you can change almost any initial settings like time zone, date, internet profiles etc.
Customization can be done automatically (Customize FS option in sonics) or manually (through script).
Script for it (without certificates)
uploadfile:c:customize.xml
/tpa/preset/custom/customize.xml
(if customize.xml is in local c: folder)
END of EDIT6
-----------------------------------------------
The Software
-------------------
SEMC_Tool 3.3
-----------------------
Can read unlock codes. These codes should unlock (untested!) a
locked phone by entering them in the SIM locks service menu which can
be entered by pressing the following sequence: >*<<*<*
(< and > are joystick moves)
Other flash functions are either disabled or don't work. My phones
were already unlocked, so I didn't test this. Would be nice if someone
can confirm whether the codes actually work.
DaVinciTeam (DVT) k750i flasher 13.7
-------------------------------------------------------
Allows flashing of SE d750/k750i/w800i with the DCU-60 data cable.
Always check the cable first by going into the flash menu and press button "Read CID / Test Cable".
EDIT5: this also shows what color your phone is
Press "Get Flash" to download files from DVT server. Unlike the
version 14.0 this version does not require a valid DVT account for
downloading and flashing.
"Completing" or finalizing a phone requires a DVT credit (€10 pricing varies).
This flasher refused to flash the latest "RED" CID36 R1N035 firmware files on my "BROWN" CID36 R1L002 phone.
DaVinciTeam remote unlocker 13.8
---------------------------------------------------
Allows flashing with the cruiser cable and not with DCU-60 (!)
Always check the cable first by going into the flash menu and press button "Read CID / Test Cable".
Unlike the version 14.0 this version does not require a valid DVT
account for downloading and flashing and repairing flash functions.
Sonics SE Tools 1.120 (cracked)
------------------------------------------------
This is a commercial tool hacked by someone. Normally it works with
a hardware dongle (Sonicsbox). This requirement was removed by the
cracker. Allows flashing, GDFS readout, repairing and completing
phones. After flashing with DVT flasher I use this tool to complete or
finalize the phone. Furthermore I use it to change the color from BROWN
to RED with CID36. Would be nice if this tool could work with DCU-60
cable. Unfortunately it doesn't and that's the reason you need a
Cruiser cable set.
Flash Procedure
------------------------
Flashing a brown firmware, e.g. W800i RK001 or RL002
(my k750i was originally a RED CID36)
1. Make sure the phone battery is fully charged
EDIT5:
2. make sure you don't have any other USB devices connected to your
computer. When my webcam is connected DVT can not flash reliable and it
interrupts flashing at random.
3. Make a backup of your GDFS file with Sonics ("Read GDFS")
4. Select the apropriate firmware files (Main and FS) in DVT k750i
flasher 13.7 or DVT remote unlocker 13.8. Leave Finalization unchecked
and click the Flash button.
---------------------
EDIT2: I had some probs with 13.7, so my strong recommendation is
to flash with DVT 13.8 !! (It's a bit hard to find in the Net tho)
---------------------
3. Unplug and replug the phone battery.
4. To Complete (Finalize) start Sonics, click "Clear Names" and
open the backup of your GDFS file in the box "GDFS or Script file"
EDIT4: 5. Check the checkbox "Customize FS",Click "Connect" and then "Flash Files"
6. Check the log pane at the right. In particular at the end it
should have succesfully written a series of certificates. There should
not be an error
7. Unplug/replug the battery and enjoy RK001 or RL002 on your converted phone. No MS Duo memory bug with these firms anymore
Ok got that firmware and you are unhappy? Let's then do the more
tricky flashing of a Red firmware (e.g. W800i R1N035) where the current
firmware is BROWN (e.g. RK001 or RL002)
1. Make sure the phone battery is fully charged
EDIT3: 2. Start Sonics, click "Unlock/Repair" Exit Sonics
(PS: this voids step 4, yeah another great improvement )
---------------------
EDIT2: I had some probs with 13.7, so my strong recommendation is
to flash with DVT 13.8 !! (It's a bit hard to find in the Net tho)
---------------------
3. Select the apropriate firmware files (Main and FS) in DVT k750i
flasher 13.7 or DVT remote unlocker 13.8. Leave Finalization unchecked
and click the Flash button.
4. After flashing in my case the phone was dead. After a lot of
blood sweat & tears I discovered that I should next flash
K750_EROM.DVT as Main file with no FS file selected. I flashed it with
DVT remote unlocker 13.8. Leave Finalization unchecked and click the
Flash button. This will flash 4 sectors and it doesn't take long. The
phone must now be Completed (Finalized) in the next steps.
5. Unplug and replug the phone battery.
6. Start Sonics, click "Clear Names" and open the backup of your GDFS file in the box "GDFS or Script file"
EDIT4: 7. Check the checkbox "Customize FS", Click "Connect" and then "Flash Files"
8. Check the log pane at the right. In particular at the end it
should have succesfully written a series of certificates. There should
not be an error.
9. Unplug/replug the battery and enjoy R1N035 on your converted
phone. That one has a MS Duo memory bug but there is a workaround here:
http://www.esato.com/board/viewtopic.php?topic=108086
----------------------------------------------------
EDIT7:
If you use Sonics you may notice that it after most of the actions
it converts your phone to BROWN. It is very much recommended that you
always convert it back to RED by:
Start Sonics, click "Unlock/Repair" Exit Sonics
----------------------------------------------------
Oh one more thing, these are steps which worked for me. I can't
gurantee they work for you. In fact you may end up with a bricked
phone. You better be warned
/JockyW
[ This Message was edited by: jockyw2001 on 2005-12-18 10:08 ]
 
|
|
Ninja Dom
Joined: Feb 16, 2005
Posts: 28
From: London, UK
| Posted: 2005-11-08 17:14
Good Post!
|
DragonEye
Joined: Sep 26, 2002
Posts: > 500
From: Canada
| Posted: 2005-11-08 17:46
thanks very very helpful
please check pm
_________________
Shaolinmonk on HOFO Official PHONE JUNKIE
MyProfile http://www.howardforums.com/m[....]s=&action=getinfo&userid=20841
[ This Message was edited by: DragonEye on 2005-11-08 16:47 ]
|
ejwghinos
Joined: Dec 13, 2004
Posts: 52
From: Greece
| Posted: 2005-11-08 18:00
Excellent post, thanks
|
DragonEye
Joined: Sep 26, 2002
Posts: > 500
From: Canada
| Posted: 2005-11-16 17:16
anybody have 13.7 or 13.8 dvt.. i went to davinci but when i downloaded the versions i found 14.0 inside
if you can email to chinaman2k@hotmail.com
thanks
_________________
Shaolinmonk on HOFO Official PHONE JUNKIE
MyProfile http://www.howardforums.com/member.php?s=&action=getinfo&userid=20841
|
jockyw2001
Joined: Oct 29, 2005
Posts: 80 | Posted: 2005-11-20 14:26
K750 13.7 and the all-phone 13.8 can be dl here:
http://rapidshare.de/files/7897975/DVT.rar.html
Sonics can be found here:
http://www.schwantz-i.com/sonyericsson/sonics.rar
EDIT1:
------
Semctool 3.3 :
http://www.unlockeasy.com/mod[....]&min=20&orderby=titleA&show=10
(PS Forget that Semctool 5.0 for the K750i/W800i which is also there, no good)
EDIT2:
------
The cruiser 4-in-1 cableset for example here:
http://www.service4handys.de/[....]=WG05&product=A000609〈=ENG
[ This Message was edited by: jockyw2001 on 2005-11-22 16:27 ]
|
plumeria
Joined: Nov 22, 2005
Posts: 5 | Posted: 2005-11-22 10:49
Hi
I have followed the steps but have one big question. How exactly do
you "complete the phone" using Sonics SE Tools? Does the GDFS flash
constitute as completing/finalizing the phone? At least I'm stille
getting the configuration error, when I start the phone again.
[ This Message was edited by: plumeria on 2005-11-22 09:51 ]
|
jockyw2001
Joined: Oct 29, 2005
Posts: 80 | Posted: 2005-11-22 17:19
To Complete (Finalize) start Sonics, click "Clear Names" and open the backup of your GDFS file in the box "GDFS or Script file"
Click "Connect" and then "Flash Files"
Meanwhile I do it w/o GDFS file, i.e. :
To Complete (Finalize) start Sonics, click "Clear Names", Click "Connect" and then "Flash Files"
Sonic will start the completion and in the log pane you can see what it does.
/JockyW
|
plumeria
Joined: Nov 22, 2005
Posts: 5 | Posted: 2005-11-22 18:02
Quote:
|
Meanwhile I do it w/o GDFS file, i.e. :
To Complete (Finalize) start Sonics, click "Clear Names", Click "Connect" and then "Flash Files"
|
|
This sounds interesting. I'm pretty sure I tried this just yesterday with a "bad" result. Let me recap, what I did.
I first unlocked my D750i using Sonics. Then I fired up DVT 13.8
and flashed W800i firmware onto it. Once that completed I went back to
Sonics and did the above thing. However, when I connected the phone it
started up instead of going in to flash mode. So I turned it off again,
AFTER it had booted the phone for the first time after the flash.
Then I tried Sonics again and had better luck this time (EDIT: with
flashing, not the end result though!). Is my problem, that the phone
had been booted before the "finalization"/"completion" phase had been
carried out?
I hope I have given enough details 'cause I ended up flashing the
phone using "TOTAL Multiserver" which did not result in the
configuration error after inputting the PIN code.
[ This Message was edited by: plumeria on 2005-11-22 17:07 ]
|
leprechaun
Joined: Dec 12, 2004
Posts: 55 | Posted: 2005-11-22 22:14
As current user of
buggy W800 FW in my D750 I was actually thinking how to switch between
FWs in simple and cost efective way in case of need ... thanks
'jockyw2001', excellent post.
|
DragonEye
Joined: Sep 26, 2002
Posts: > 500
From: Canada
| Posted: 2005-11-22 22:29
I can't get sonic to connect at all.. any trouble shooting tips?
all it does is turn the phone on when i try to "read gdfs"
is it the cable?
i have tested the same cable with usbsmart 3.3 and 5.0 and it was
able to reset timer and enable fieldtest so i think the cable is good.
_________________
Shaolinmonk on HOFO Official PHONE JUNKIE
MyProfile http://www.howardforums.com/member.php?s=&action=getinfo&userid=20841
|
plumeria
Joined: Nov 22, 2005
Posts: 5 | Posted: 2005-11-22 22:44
UPDATE :: IT WORKS !!
Hi again. I just wanted to let you all know what caused my problems.  )
It would have been extremely nice if someone had told us, that you have
to have the "Customize Fs" check box checked for the
"finalization"/"completion" to work.
Anyways - now I have W800i firmware running on my D750i and I feel
pretty comfortable if I have to go back to K750i firmware because of
the bugs, that people have reported on the latest W800i edition.
Would be nice Jockey, if you make an update to your guide since all
that was lacking for me to get it to work was the damned check box. )
|
jockyw2001
Joined: Oct 29, 2005
Posts: 80 | Posted: 2005-11-22 22:52
Cool I thought it was obvious that that checkbox needs to be checked 
Yeah, I'll update the "manual" at the start of this thread.
Btw: what w800i firmware version are you running now? Can you also
please check the color of your phone (RED or BROWN) by doing a "Read
CID/Check Cable" with DVT.
Cheers, JockyW
|
DragonEye
Joined: Sep 26, 2002
Posts: > 500
From: Canada
| Posted: 2005-11-22 22:59
do i need to click the check box to custimize the gdfs too? i'll try when i get home....
_________________
Shaolinmonk on HOFO Official PHONE JUNKIE
MyProfile http://www.howardforums.com/member.php?s=&action=getinfo&userid=20841
|
jockyw2001
Joined: Oct 29, 2005
Posts: 80 | Posted: 2005-11-22 23:09
Quote:
|
On 2005-11-22 22:29:08, DragonEye wrote:
I can't get sonic to connect at all.. any trouble shooting tips?
all it does is turn the phone on when i try to "read gdfs"
is it the cable?
i have tested the same cable with usbsmart 3.3 and 5.0 and it was
able to reset timer and enable fieldtest so i think the cable is good.
|
|
Test with DVT 13.8 "Read CID/Test Cable". Make sure you correctly
installed the driver for your Cruiser cable and select the right COM
port in Sonics. Disconnect all other USB devices from your computer (my
webcam caused hickups!!). Your phone battery should be fully charged
(>90%). It helps to disconnect the Cruisercable from your computer
and to reconnect it before you start Sonics (or any other flasher
tool). Close all other flasher tools before you start Sonics. And very
important: you must have 3V (2x1.5V AA batteries) connected to the
Cruiser cable!!!
I always connect the Cruiser cable first to phone and computer with
the phone battery unplugged. Then I start Sonics, then I connect the
battery and finally I click the "Connect" button in Sonics.
I use the same procedure with DVT.
/JockyW
|
