K1/Z3/L7e - Remove RSA without TP

[rodrigocastrillon]

Hey duuuuudes!

I was talkin' with Osta@motofan about removeing RSA without TP, using the method I posted to unlock without TP.
Some guys at motofan are able to remove RSA without lots of "corpses". The thread is brand new (18.1.2008, 5:08) and a loooooot of people is testing and they are achieving good results.
You can see the original thread here:http://forum.***********/index.php?showtopic=135703&st=255&#entry1017751.

_______________
Admins & moderators:I NEED to share this! It is very important to the K1/Z3/L7e community!
I do not have time, so you can download the flashes and re-upload them to other place and replace all the links I've posted! Sorry, really sorry 4 the trouble with the rules!
Users: please replace all ******* with "m o t o f a n . r u" (without spaces).
_______________

AND REMEMBER: DO THIS AT YOUR OWN RISK!


What you will need:

- Mstool (google it 4 download);
- RSDLite (google it 4 download);
- Flash & Backup 3.0.6 (google it 4 download);
- K1__BOOTCORE_TP.bkp;
- Boot_0AC0_patch.bin;
- Boot_Start_SW.bin;
- Patched reflash/MP (Look in the end of this tutorial).

To see if your cel support this tutorial:
1. Open mstool, click "Handset" and select your model K1 or Z3;
2. Connect phone in bootloader mode usiung the *+# + "power on";
3. Click in "Read Backup" and check PDS;
4. Make sure the backup was successful.
If something appears in the unit as "Critical error" during the backup does not follow this topic!

Removing RSA:
1. Connect phone in bootloader mode again usiung the *+# + "power on";
2. Click "write backup" and select Z3__BOOTCORE_TP.bkp (if you have a Z3 or L7e) or K1__BOOTCORE_TP.bkp (if you have a K1);
3. Wait untill the app do it's job. After it finishes, your phone gets BLACK SCREEN, this is OK;
4. Close the program and remove the battery and then insert in the phone again;
5. Turn on the phone using the red button;
6. Run RAMLdr2;
7. Click "send loader" and wait for the "ready" message;
8. Click "write boot" and select the Boot_0AC0_patch.bin;
9. Wait. The phone will be automatically shut off;
10. Close RAMLdr2 and run FB3;
11. Download a RSA removed reflash (look down there) and flash it;
12. Close FB3 and open RAMLdr2;
13. Remove the battery and put it again. Wait until the program recognize the phone;
14. Click "send loader" and wait the "ready" message;
15. Click "write boot" and select Boot_Start_SW.bin;
16. DONE!!! Turn on the phone and do whatever you want with your CG1! RSA is gone!!

If something goes wrong:

1. Make a hard TP;
2. Got to #6 step and do all over again!

_____________________________
Flashes & MPs with RSA removed:


K1:
Patched reflash - full access to the file system enabled - 22.11R. --> by me ;
Patched reflash - full access to the file system enabled - 42.0BR. --> by me ;
http://forum.***********/index.php?a...post&id=153992
http://forum.***********/index.php?a...post&id=153993

I am developing a 42.0BR s/w with all patches necessary to run Java with full acces to the FS.
_____________________________

All credits go to Osta (mainly) and Rodrigo Castrillon for the method and for GandjaFuzz and Vilko who made the patched bootloaders.

GOOD LUCK!!!

[moto_default]

Thank you rodrigocastrillon. This needs to be Stickied...I am going to try this one too. One question where do you get the RAMLdr2? In step 6? Rest I have all the files. So as soon as I get a reply I will crack my RSA and post results...

[rodrigocastrillon]

Try searching RamLDR2 here: http://www.4shared.com/network/search.jsp
RamLdr is NOT warez, so I think tomorrow I'll post this great app here.

Good luck with the tutorial dude!

[moto_default]

Got it thank you rodrigocastrillon, Now I will get the RSA removed and post results...!!

[Trickybitch]

Anyone test and confirm that it works?

[p0rr4l0k4]

Loll what is this RAMLdr2??? its a program ??? send to me please im stop in this step.. phone is Black Screen... thnxxx!!!!

[rodrigocastrillon]

Hahhahahha! Since you don't know what is Ramldr2, I think you should not have started the tutorial.
But I guess you are a very brave modder and like to test new stuff! So, just write "ramldr2" here: http://www.4shared.com/network/search.jsp and download it!

Good Luck dude!!!!

[p0rr4l0k4]

I try install itunes and no works for me =/ You have tested it ??? works fine???? i execute tutorial exatly.... and i cant install itunes per cel.. have one methrod for see if RSA Is removed or no ?

[zoryk]

Can a monster pack just be made and flashed onto a non-RSA removed phone?

[rodrigocastrillon]

Dude, to flash a new MP you will have to patch it. Or else you'll kill the phone!
Only Mps without RSA allowed!

See ya

[darkmike57]

Is there any way that i can just patch my own MP? I really like the way my KRZR is at now.

And what are the big benefits of removing RSA? I know iTunes doesn't work yet.

[moto_default]

@darkmike57 you will be able to run itunes or any other player on your fone, with RSA removed and will have several java app hacks and access to complete file systems, etc

[darkmike57]

Alright thanks.

How can i patch my own MP?

[rodrigocastrillon]

I try install itunes and no works for me =/ You have tested it ??? works fine???? i execute tutorial exatly.... and i cant install itunes per cel.. have one methrod for see if RSA Is removed or no ?

I will update the 1st post...
If you remove RSA, the java apps still don't work. You have to apply some patches to CG1 in order to give the full access to the file system.
I made a patched reflash (THIS ONE - It is the 3rd link in 1st post --> edit: now is the 1st link, take a look ) that you can flash to your phone and just install whatever you want.
The other 2 moto*fan reflashes just have RSA removed and dualboot, but they are not patched.
To test the RSA removal and the FS access, flash my reflash and install an app like minicommander.
The system will ask for access to the FS, but the option "never ask" is now enabled.

Alright thanks.

How can i patch my own MP?

Yes, you can patch your own MP. But the files in the 1st post are just reflashes. After the flashing process, your phone will stay as before, with your mods and phonebook, etc.

________________________________________

Files UPDATED! Now you can use a 42.0BR without RSA, full access stuff enabled!

[Trickybitch]

Thanks Rodri You're doing some good work in these forums