PDS repair ideas

**zedbra** · 06-23-2007, 10:55 AM

Great job Jocky....BIG thumbs up!! I havn't had any time lately to work on my fon, but if you need any more PDS comparisons, i have four good ones and two bad. Really excellent work folks, i know you're gonna get it. WooHoo!!

**moond0ggie** · 06-23-2007, 11:35 AM

Yea, great initiative there,
I was sure that would be a project!
It's probably going to be one of those drawn-out research type things
that you chip away on.
I'll post with anything I discover.

**jockyw2001** · 06-23-2007, 01:00 PM

Originally Posted by zedbra

Great job Jocky....BIG thumbs up!! I havn't had any time lately to work on my fon, but if you need any more PDS comparisons, i have four good ones and two bad. Really excellent work folks, i know you're gonna get it. WooHoo!!

Would be great if you could mail them. But only if a good and a bad one belong to the same phone.

Actually a great idea zedbra to figure out what gets screwed after a bad PDS repair. I will have to nuke my silver again it seems

**echoo69** · 07-03-2007, 07:33 AM

I'm waiting the guide pds repair? Thx

**moond0ggie** · 07-03-2007, 09:46 AM

If there was a way to develop a genuine working software PDS repair,
someone could make $$$.$$$

**jockyw2001** · 07-07-2007, 07:43 AM

The information in this post is partly duplicated from another thread, but it fits perfectly here and this thread should be the knowledgebase for PDS repair

================================================== =
I just repeated the repair process of my silver V3 and copied the screen output of this special version of USB-Smart Cyclone P2K Easy Tool 4.1 which was h*cked by GohAnZ (versione senza winscard.dll).
That's the app which can definitely repair your V3

See: http://www.modmymoto.com/forums/show...6&postcount=17

I made an analysis of the PDS file it creates and it seems to contain the same number of seems as before. The IMEI it reports is the original phone IMEI. The number and the type of active seems after the repair is the same as before the repair. The number of not-active seems (#17) is far less as before the repair (#80). I'm pretty sure the 17 seems below are the main repair candidates.

Code:

0016 factory_tracking
005F subsidy_lock_gsm_hlr_table
0161 subsidy_lock_gsm_sim_sp_code
0189 subsidy_lock_secondary_sp_code
01BB service_password
01C3 global_feature_protected_state_nvm
01C4 global_feature_protected_state_default_nvm
01C5 global_feature_protected_value_nvm
01C5                      ,,         
01C6 global_feature_protected_value_default_nvm
01C6                      ,,         
01C7 global_protected_flex_table
02D2 boot_sw_version
02D2           ,,         
02D3 boot_flex_model
02D3           ,,
02D4 "r3.7.4_razor_pds_001"

Code:

Connecting to phone ...
Connected to: 'Motorola Flash'
Connected OK
Bootloader version: 0826 
Downgrade flash bootloader ...
Connecting to phone ...
Connected to: 'Motorola Flash'
Connected OK
Bootloader version: 07E0 
Sending loader to phone ...
Loader sent OK.
Write Repair Flash bootloader ... => it writes repair flash bootloader 0200
Powering down... => I made a backup of the first 16MB here: backup21
Connecting to phone ...
Connected to: 'Motorola Flash'
Connected OK
Bootloader version: 0200 
Sending repair loader to phone ... => I'm quite sure it sends a ramloader which can handle "RPDS" cmd
Loader sent OK.
Write PDS part ...
Rebuild PDS area ...
Write Flash Bootloader ... => it writes bootloader 07E0
Powering down... => I made a backup of the first 16MB here: backup2
Repaired OK

I compared backup1 with backup2 and following areas are different:
0x00000000 - 0x00010000 This is the bootloader area
0x00010000 - 0x00020000 PDS area
0x00020000 - 0x00030458 2nd bootloader area?? (empty after repair)
0x00080000 - 0x00080004 Jump vector?? (backup1: 0x000007FB; backup2: 0x1091F1BB)

So basically the repair process involves following steps:
1. Flash a repair flash bootloader which occupies 0x00000000 - 0x00010000 and 0x00020000 - 0x00030458
2. Make sure that the PDS which needs to be repaired is at 0x00010000 - 0x00020000 (preferrably a PDS from another phone)
3. Make sure a jump vector is set @0x00080000 to 0x000007FB
4. Boot phone in flash interface mode with * #
5. Send a RAM loader which can handle the RPDS ("Restore PDS") command
6. Send the RPDS command
7. Flash bootloader 07E0

So what we need to extract is the RAM loader in step 5.

By all means correct me if I'm wrong about all of this ****

UPDATE: I flashed an empty PDS (64KB 0xFF) and P2K ET 4.1 repaired it perfectly

**zedbra** · 07-12-2007, 09:23 PM

Hey folks, just reading up on your progress.... NICE!! Sorry i've missed out on a lot but my 'puter crashed, borrowing a friends' for now. Anyway keep up the good work!! Doing it for a noble cause!

YES!! Success!! using the p2k tools_v2(in Ruski) suggested by JockyW worked like a charm!! Beautiful work here gents. Thanx!!!

**spyderwork** · 07-22-2007, 05:06 PM

I have a Razr v3t (i think that's the model). I completely bricked it during a flash...it isn't recognized by the computer in any way. What can I do?

**Dumba** · 07-22-2007, 05:09 PM

Originally Posted by spyderwork

I have a Razr v3t (i think that's the model). I completely bricked it during a flash...it isn't recognized by the computer in any way. What can I do?

Whats written under your battery?

**spyderwork** · 07-22-2007, 06:29 PM

Well it says V3 (g8/9/18/19) not entirely sure if they all say V3 and then somewhere else it's different or what...

**zedbra** · 07-23-2007, 10:09 AM

i think he means the S/W version. this info should be to the right of the #'s you posted. ie: 07.E0, or 08.26, or 0A.50, etc. Try forcing bootloader and connecting to rsd lite to see if the computer recognizes your phone.

**spyderwork** · 07-23-2007, 07:48 PM

The computer won't recognize it at all...i get the keyboard light-flash and nothing. No screen no bootloader. I know the BL was 0a.52 though. The SW is 0e.c0.17r

**zedbra** · 07-23-2007, 08:11 PM

sounds like a v3r. there is another forum here for that model, however.... if rsd wont recognize it after repeated tries,(you should try several times before giving up) then youre really bricked good!!! im not too familiar with the v3r, but i think you might have to do a testpoint to get RSD to "see" the phone and flash the rfdi image file. Dunno if GOT will fix the v3 from that severe of a state. for five bucks, it is worth a try instead of the TP method......TP is delicate work.

**jockyw2001** · 07-24-2007, 05:02 AM

Originally Posted by zedbra

sounds like a v3r. there is another forum here for that model, however.... if rsd wont recognize it after repeated tries,(you should try several times before giving up) then youre really bricked good!!! im not too familiar with the v3r, but i think you might have to do a testpoint to get RSD to "see" the phone and flash the rfdi image file. Dunno if GOT will fix the v3 from that severe of a state. for five bucks, it is worth a try instead of the TP method......TP is delicate work.

Afaik any phone which can not be "seen" needs TP.

**zedbra** · 07-24-2007, 07:52 AM

hey jocky good to hear your voice!! any new endeavers??

Thread: PDS repair ideas

LinkBack

Thread Tools

Display

The Following User Says Thank You to zedbra For This Useful Post:

3 Users Say Thank You to jockyw2001 For This Useful Post

Posting Permissions