[SOLVED] Recover Motorola V3i from SIG ERR: 35:02:/39:02:

[hotrod_nathaniel]

Hello fellow modders!

I just wanted to share my experience on how to solve sig err: 35:02:. This procedure was done using my Motorola V3i but I think it is applicable for any other device. This procedure worked for me but it does not mean that it will also work for you. TRY THIS AT YOUR OWN RISK!

Just like all of you who suffered from this error, I tried to search everywhere in the internet to find an answer for this problem and it always leads to the same solution: "DO A TEST POINT."

I'm really afraid of doing a test point. I think it is very hard for me to do that because first of all, I don't have the courage to do it. I also don't have the tools needed to do it and I'm afraid of bricking my phone just in case I have done something wrong while doing the procedure.

I just discovered this out of desperation. hahaha...
NOTE: This is ONLY for those who have bootloader 0A.52 and with unremoved RSA protection) Thanks alaminok for reminding me to post this.

Here's my phone's details:

Firmware Version: R479_G_08.B4.85R
Bootloader Version: 0A.52
RSA protection: Unremoved


Things you will need:

Your phone w/ a fully charged battery.
USB cable
USB Drivers for your phone
P2kToolsVS 3 (just google this)
An upgraded firmware version (higher than the version of the phone you currently have) - just search for the available firmware for your phone in the Downloads Section
Flash and Backup 3 (google this also)

Step 1: Erasing your phone's memory. (see attachments for screenshots)

- Make sure you have your phone fully charged when doing this so that there will be no interruptions.

- Press and hold *, #, and End Call key on your phone's keypad (You should press these all at once) to enter the bootloader screen of your phone.

- Open the P2KToolsVS 3 program.

- Connect your phone.

- Click the phone icon on the left portion of the program window.

- On the dropdown box, click Flash Mode. Wait until phone is successfully connected. Clicking this might install drivers for your phone if this is the first time you used this program. (Note: there is an indicator on the lower left portion of the program window. The red icon will turn into violet/purple once the phone is connected.)

- Once the phone is successfully connected, on the left side of the program window, press flash terminal.

- On the RAM Downloader section, there are two fields: Address and Entry Point.
Enter these details: (For Motorola V3i ONLY)
Address: 03FC8000
Entry Point: 03FC8010
Note: For other phone models, you can find these information on the box under the memory operations section of the program window. (see screenshots to understand clearly)
The information in the box looks like this:

V3i (R479) -----> device model
Ramdownloader: V3i (0A40).ldr
ramldr addr = 03FC8000
entry point = 03FC8010

--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=100A0000-1135FFFF
CG2=117C0000-12F5FFFF
CG3=10040000-1009FFFF
CG4=115E0000-117BFFFF
CG7=12F80000-12F9FFFF
CG15=11360000-115DFFFF
CG18=12FE0000-12FE07FF

- Click SEND LOADER. Wait until the process finishes on your phone.

- On the Memory Operations Box, enter the following details (For Motorola V3i ONLY):
Start Address: 10000000
End Address: 12FE07FF
You might wonder where I got these info. Base it from the information given above. The start address is from the BOOT (under code groups), in dark red and the end address is from the CG18, also in dark red. Just do the same for other devices (Take note to base the information according to your device model indicated on the top of every info in the box)
(Note: Always double check the information you enter)

- Click ERASE MEMORY. Wait until the process finishes. When done, the SIG ERR: 35:02 will be replaced by something that says Memory Map Reqd. Something like that.

- Exit the P2KTools program and just disconnect your phone.

Step 2: Flashing an Upgraded Firmware.

- Open Flash and Backup 3. On the Active Phone Profile Dropdown Box, choose your device. In my case, Motorola V3i. Then Connect you phone via usb cable and wait until it is successfully detected.

- Click Write Data.

- Click Select Flash File. Choose the flash file that you have downloaded. (This is the updated firmware. In my case, I currently have R479_G_08.B4.85R so I downloaded a higher version R479_G_08.B4.89R)

- Click Write Data Button under the Select Flash File Button.

- Wait until the flashing is finished. Check out if the procedure was successful and if your phone is back to normal.

- Disconnect your phone.

Let me hear your feedbacks. Let me know if this tutorial helped you in any way. Please hit Thanks if this helped. Happy Modding!

[alaminok]

Its is appreciated, but..
What is the bootloader after doing all this ?
pleaze post that info also.

[hotrod_nathaniel]

Thanks. The bootloader is still 0A.52
I made this thread for those who have phones with bootloader OA.52 or phones with unremoved RSA protection. I hope it could help.

[alaminok]

Nice .
It is exclusively helpful to those who are a bit scared to do testpoint and brick . Though we will be there to help to get out from brick.

Lets see, who elze find this post/thread valuable.

[zedbra]

interesting, im looking to use this info for other purposes. if i get good results i'll let you guys know

[hotrod_nathaniel]

interesting, im looking to use this info for other purposes. if i get good results i'll let you guys know

Thanks.

Nice .
It is exclusively helpful to those who are a bit scared to do testpoint and brick . Though we will be there to help to get out from brick.

Lets see, who elze find this post/thread valuable.

Thanks for appreciating it. Because of my fear of doing the testpoint thing, I was able to do this. haha.

I'll just wait for other comments and see if other modders could find this solution helpful.

[FiruzzZ]

Alo.. I had been this error for almost a year, every time that my V3i is turned off, I have to keep pressing a loooooooot of time the End Botton to turn on again (last time almost 2 hours)

I got
Bootloader Version: 0A.52
Firmware Version: R47A_G_08.D8.88R
RSA protection: (I don't know how to check this)

I tried to do TP but didn't work (IDK why).

Well.. the point if, this method could work with my cell having a different Firmware?

[hotrod_nathaniel]

I also don't know if it will work for you 'coz my phone is R479. According to the list provided by the program P2KTools VS 3, there are a lot of models supported but I don't see V3i(R47A). Here's the complete list of supported models with their corresponding codegroup addresses:

V300, V500, V600 (TRIPLETS)
Ram Size 32 MB
Ramdownloader: (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-1117FFFF
CG2=11380000-11FDFFFF
CG3=10040000-1007FFFF
CG4=11180000-1137FFFF
CG18=11FE0000-11FFFFFF

Generic for LTE phones with boot ver. up to 08.28 (BOOT only)
Ram Size 16 or 32 MB
Ramdownloader: (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF

Generic for 3G phones with boot ver. up to 06.10 (PDS only)
Ramdownloader: E1000 (0610).ldr
ramldr addr = 08000000
entry point = 08000010
--- Code Groups ---
PDS=10010000-1001FFFF

V3i (R479)
Ramdownloader: V3i (0A40).ldr
ramldr addr = 03FC8000
entry point = 03FC8010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=100A0000-1135FFFF
CG2=117C0000-12F5FFFF
CG3=10040000-1009FFFF
CG4=115E0000-117BFFFF
CG7=12F80000-12F9FFFF
CG15=11360000-115DFFFF
CG18=12FE0000-12FE07FF

U6 PEBL (R478)
Ram Size 32 MB
Ramdownloader: 32 MB (0A02).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10D5FFFF
CG2=11160000-11F5FFFF
CG3=10040000-1007FFFF
CG4=10FA0000-1115FFFF
CG7=11F80000-11F9FFFF
CG15=10D60000-10F9FFFF
CG18=11FE0000-11FFFFFF

V635 (R474)
Ram Size 32 MB
Ramdownloader: 32 MB (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CDFFFF
CG2=110C0000-11FDFFFF
CG3=10040000-1007FFFF
CG4=10F20000-110BFFFF
CG7=11F80000-11F9FFFF
CG15=10CE0000-10F1FFFF
CG18=11FE0000-11FFFFFF

V547 (R472)
Ram Size 32 MB
Ramdownloader: 32 MB (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CFFFFF
CG2=11140000-11FDFFFF
CG3=10040000-1007FFFF
CG4=10F40000-1113FFFF
CG7=11F80000-11F9FFFF
CG15=10D00000-10F3FFFF
CG18=11FE0000-11FFFFFF

V186 (R465)
Ram Size 16 MB
Ramdownloader: 16 MB (0823).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-1091FFFF
CG2=10B20000-10FFFFFF
CG3=10040000-1007FFFF
CG4=109E0000-10B1F7FF
CG15=10920000-109DFFFF
CG18=10B1F800-10B1FFFF



KRZR K1 (R4527), RIZR Z3 (R452B), L7e (R452D)
Ramdownloader: Z3 (0AC2).ldr
ramldr addr = 03FC8000
entry point = 03FC8010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10092000-115DFFFF
CG2=11AC0000-13F5FFFF
CG3=10040000-10091FFF
CG4=11860000-11ABFFFF
CG7=13F80000-13F9FFFF
CG15=115E0000-1185FFFF
CG18=13FE0000-13FE07FF

KRZR K1, RIZR Z3, L7e (R4527)
Ramdownloader: K1 (0AB2).ldr
ramldr addr = 03FC8000
entry point = 03FC8010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10092000-115DFFFF
CG2=11AC0000-13F5FFFF
CG3=10040000-10091FFF
CG4=11860000-11ABFFFF
CG7=13F80000-13F9FFFF
CG15=115E0000-1185FFFF
CG18=13FE0000-13FE07FF

V3r (R4515)
Ramdownloader: R4515 (0A40).ldr
ramldr addr = 03FC8000
entry point = 03FC8010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10092000-10DFFFFF
CG2=111C0000-11F5FFFF
CG3=10040000-10091FFF
CG4=11040000-111BFFFF
CG7=11F80000-11F9FFFF
CG15=10E00000-1103FFFF
CG18=11FE0000-11FE07FF

V360 (R4513) (With 08.A0 boot)
Ramdownloader: V360 (08A0).ldr
ramldr addr = 03FC8000
entry point = 03FC8010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10092000-10D1FFFF
CG2=11240000-11F5FFFF
CG3=10040000-1008FFFF
CG4=110A0000-1123FFFF
CG7=11F80000-11F9FFFF
CG15=10E60000-1109FFFF
CG18=11FE0000-11FEFFFF

V360 (R4513)
Ramdownloader: L7 (08D0).ldr
ramldr addr = 03FC8000
entry point = 03FC8010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10092000-10E5FFFF
CG2=11240000-11F5FFFF
CG3=10040000-10091FFF
CG4=110A0000-1123FFFF
CG7=11F80000-11F9FFFF
CG15=10E60000-1109FFFF
CG18=11FE0000-11FE07FF

SLVR L7 (R4513)
Ramdownloader: L7 (08D0).ldr
ramldr addr = 03FC8000
entry point = 03FC8010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10092000-10E5FFFF
CG2=11240000-11F5FFFF
CG3=10040000-10091FFF
CG4=110A0000-1123FFFF
CG7=11F80000-11F9FFFF
CG15=10E60000-1109FFFF
CG18=11FE0000-11FE07FF

V620 (R376)
Ram Size 32 MB
Ramdownloader: 32 MB (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CDFFFF
CG2=110C0000-11FDFFFF
CG3=10040000-1007FFFF
CG4=10F20000-110BFFFF
CG7=11F80000-11F9FFFF
CG15=10CE0000-10F1FFFF
CG18=11FE0000-11FFFFFF

RAZR V3 (R374)
Ram Size 32 MB
Ramdownloader: 32 MB (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CFFFFF
CG2=11140000-11FDFFFF
CG3=10040000-1007FFFF
CG4=10F40000-1113FFFF
CG15=10D00000-10F3FFFF
CG18=11FE0000-11FFFFFF

E398 (R373) (Reflashed to E1)
Ram Size 32 MB
Ramdownloader: 32 MB (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CFFFFF
CG2=11100000-11F5FFFF
CG3=10040000-1007FFFF
CG4=10F40000-110FFFFF
CG7=11F80000-11F9FFFF
CG15=10D00000-10F3FFFF
CG18=11FE0000-11FFFFFF

E1 ROKR (R373)
Ram Size 32 MB
Ramdownloader: 32 MB (0A02).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CFFFFF
CG2=11100000-11F5FFFF
CG3=10040000-1007FFFF
CG4=10F40000-110FFFFF
CG7=11F80000-11F9FFFF
CG15=10D00000-10F3FFFF
CG18=11FE0000-11FFFFFF

E398 (R372)
Ram Size 32 MB
Ramdownloader: 32 MB (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CFFFFF
CG2=11140000-11FDFFFF
CG3=10040000-1007FFFF
CG4=10F40000-1113FFFF
CG15=10D00000-10F3FFFF
CG18=11FE0000-11FFFFFF

E375 (R3721)
Ram Size 32 MB
Ramdownloader: 32 MB (2526).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10CDFFFF
CG2=110C0000-11F5FFFF
CG3=10040000-1007FFFF
CG4=10F20000-110BFFFF
CG15=10CE0000-10F1FFFF
CG18=11FE0000-11FFFFFF

C390 (R368)
Ram Size 16 MB
Ramdownloader: 16 MB (0823).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-1095FFFF
CG2=10B60000-10FFFFFF
CG3=10040000-1007FFFF
CG4=10A20000-10B5F7FF
CG15=10960000-10A1FFFF
CG18=10B5F800-10B5FFFF

C381P (R366)
Ram Size 16 MB
Ramdownloader: 16 MB (0823).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-1097FFFF
CG2=10B80000-10FFFFFF
CG3=10040000-1007FFFF
CG4=10A40000-10B7F7FF
CG15=10980000-10A3FFFF
CG18=10B7F800-10B7FFFF

C650 (R365), C380 (R365), V220 (R365), V180 (R365), V188 (R365)
Ram Size 16 MB
Ramdownloader: 16 MB (0823).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-1091FFFF
CG2=10B20000-10FFFFFF
CG3=10040000-1007FFFF
CG4=109E0000-10B1F7FF
CG15=10920000-109DFFFF
CG18=10B1F800-10B1FFFF


L6 (R3511)
Ram Size
Ramdownloader: L6 (08D0).ldr
ramldr addr = 03FD0000
entry point = 03FD0010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10080000-10D1FFFF
CG2=10F60000-11F5FFFF
CG3=10040000-1007FFFF
CG4=10E60000-10F5FFFF
CG7=11F80000-11F9FFFF
CG15=10D20000-10E5FFFF
CG18=11FE0000-11FE07FF

E1000 (R26LD), V980 (R24_R26)
Ram Size 64 MB
Ramdownloader: E1000 (0631).ldr
ramldr addr = 08000000
entry point = 08000010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10040000-1101A4C7
CG2=11580000-1337FFFF
CG4=11380000-1157FFFF
CG5=1104C4C8-111FF7FF
CG8=13F40000-13F7FFFF
CG15=11200000-1137FFFF
CG17=1101A4C8-1104C4C7
CG18=111FF800-111FFFFF

V3x (R252211LD), E770v (R252211), E1070 (R252211LD)
Ram Size
Ramdownloader: V3x (0682).ldr
ramldr addr = 08000000
entry point = 08000010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10040000-118DA4C7
CG2=11DC0000-138BFFFF
CG4=13BC0000-13F3FFFF
CG5=1190C4C8-11DBF7FF
CG8=13F40000-13F7FFFF
CG15=139C0000-13BBFFFF
CG17=118DA4C8-1190C4C7
CG18=11DBF800-11DBFFFF

RAZR V3xx (R26111L)
Ram Size
Ramdownloader: V3xx (0302).ldr
ramldr addr = 08000000
entry point = 08000010
--- Code Groups ---
BOOT=A0000000-A000FFFF
PDS=A0010000-A001FFFF
CG1=A0080000-A1DD77FF
CG2=B4020000-B58FFFFF
CG3=A1DD7800-A1FD77FF
CG4=B5900000-B5BFFFFF
CG7=B5F80000-B5F9FFFF
CG15=B5C00000-B5F5FFF8
CG17=A1FD7800-A1FFF7FF
CG18=A1FFF800-A1FFFFFF

V6 MAXX (R26111VL)
Ram Size
Ramdownloader: V6 (0302).ldr
ramldr addr = 08000000
entry point = 08000010
--- Code Groups ---
BOOT=A0000000-A000FFFF
PDS=A0010000-A001FFFF
CG1=A0080000-A1DD77FF
CG2=B4020000-B58FFFFF
CG3=A1DD7800-A1FD77FF
CG4=B5900000-B5BFFFFF
CG7=B5F80000-B5F9FFFF
CG15=B5C00000-B5F5FFF8
CG17=A1FD7800-A1FFF7FF
CG18=A1FFF800-A1FFFFFF

V6 MAXX (R26117LD)
Ram Size
Ramdownloader: V6 (0302).ldr
ramldr addr = 08000000
entry point = 08000010
--- Code Groups ---
BOOT=A0000000-A000FFFF
PDS=A0010000-A001FFFF
CG1=A0080000-A1EBFFFF
CG2=B4020000-B577FFFF
CG3=A1EC0000-A1FFEFFF
CG4=B5980000-B5BDFFFF
CG7=B5F80000-B5F9FFFF
CG11=B5780000-B597FFFF
CG15=B5BE0000-B5F5FFFF
CG17=A1FFF000-A1FFF7FF
CG18=A1FFF800-A1FFFFFF

V980 (R24_R26)
Ram Size 32 MB
Ramdownloader: E1000 (0631).ldr
ramldr addr = 08000000
entry point = 08000010
--- Code Groups ---
BOOT=10000000-1000FFFF
PDS=10010000-1001FFFF
CG1=10040000-1101A4C7
CG2=11580000-11F7FFFF
CG4=11380000-1157FFFF
CG5=1104C4C8-111FF7FF
CG8=10028000-1003FFFF
CG15=11200000-1137FFFF
CG17=1101A4C8-1104C4C7
CG18=111FF800-111FFFFF

Sorry for that. You may try doing a testpoint again. You might get lucky this time. ^_^
Don't be afraid to try other options. Try to explore features of other p2k programs. You might discover a solution. At least you're not afraid of doing a test point unlike me. Inform us if you got your phone to work again.

[chupadacabra]

Confirmed working on R4441D_g_08.02.03R BL 0A.52.

I had 39:02 first, then i followed to oldguide for RSA removal and got 35:02.
With phone code sig err 35:02 this guide worked. But not with 39:02.

Thank you very much for this useful guide!

[odaneinja]

still did not help still stuck with the same error.....are there any successful attempts

[Hendz]

Hey guyz..... but how to REMOVE RSA Protecions??? so we can easily plant it with ELFs / Patches
Thankz

BTW, mine is 0A.52 with FW B5.86R -- and I hate testpoint though it's no problem n quiet safe for me when it done

[Saurus]

still did not help still stuck with the same error.....are there any successful attempts

What is your phone model and firmware/bootloader?

Hey guyz..... but how to REMOVE RSA Protecions??? so we can easily plant it with ELFs / Patches
Thankz

BTW, mine is 0A.52 with FW B5.86R -- and I hate testpoint though it's no problem n quiet safe for me when it done

Guide: "RSA Removal for Dummies" and more

[Hendz]

@Saurus

Thankz alot! You SAVED ma life
Here's ma ten-sequence to "escape" from BL 0A.52 prison-chamber and much suffered within, while don't know where can I get some fresh air for.

1. Ma old BL is 0A.52 with ma own beauty Monster called "NeNk FiTRi" (R479_G_08.B5.86R) smoothly running in.
2. Then I downgrading it into BL 0A.30 as suggested by Testpoint Method of Anhvu2875's, and got lucky.
3. Ma new BL is now 0A.30
4. But the phone was suddently back on with the monster still running perfectly.
5. Try to flash it away with R4441D but failed, phone still on with that monster coming in (I thought the phone should be blank as mentioned in tutorials but it didn't).
6. Now I realize that once 86R planted inside, we can't do anythin than just having it all times and it so sad
7. Well I started to remove RSA-Signature as written by Random and got succeed.
8. The phone still now has ma monster inside but with fully RSA Removed. So I think this is just the same as "natural" R4441D or any other FW but with some capabilities built-in, like for example no more need to patch for EDGE activation & 2GB microSD card capability.
9. Then I started last night to give full-access for all JAVA, installing iTunes together with Digital Audio Player, etc.
10. And ma next plan is feeding ELFs like any other monsters have ... and I gotta say Thank to God with this 86R-kernel remains intact.

So, by gettin thru that sequence of ma V3i lifejourney, I'm now completely thinkin that I almost got a powerfuL Monster like other guyz had ..... and bye bye 0A.52 bad-prison!

[fancyzamry]

NOTE: This is ONLY for those who have bootloader 0A.52 and with unremoved RSA protection) Thanks alaminok for reminding me to post this.[/COLOR]
[/COLOR]

how about boot loader 0a.30??
please advice me.. thanks ya!

[Saurus]

You have to use the old test point method Guide: "RSA Removal for Dummies" and more by overgrownmoose. Unfortunately the images have expiredat their host site (it's a very old post), and they contained essential information. Check around other sites, the same guide (more or less) can be found in several places.