Page 1 of 3 123 LastLast
Results 1 to 15 of 39
  1. #1
    offline Maybe Modder
    Join Date
    Jun 2007
    Posts
    47
    Thanks
    9
    Thanked 21 Times in 13 Posts
    Downloads
    15
    Uploads
    0

    PDS repair ideas

    The phone can be in any degree of bricked state, but as long as you have a backup of your PDS it can be brought back alive. We all know that, but it still happens that in our modding enthousiasm, we forget to make a backup or due to a harddisk crash we lose them.

    So what to do in such cases? Some of us, myself included, try those fancy h*cked proggies which have this "PDS Repair" function. I tried many only to find my phone even more severely bricked afterwards. I have searched and read countless threads about it, but haven't found the ultimate solution yet. It seems the PDS repair function only works when you have the associated hw dongle such as the Smartclip.

    I believe I now finally found something which is worthwhile to pursue. The idea is to take someone else's working PDS and then to change the IMEI seem in PDS such that it matches the IMEI which sits in your phone's read-only memory (OTP). As you will probably know, if you take someone else his PDS the phone will not start. This is because the firmware compares the PDS IMEI with the one in OTP. If the numbers don't match the phone will power off.

    I found an interesting thread in gsmforum which describes the process of changing seem 0004 which apparently is a copy of the OTP IMEI. The number is scrambled a bit, but it shouldn't be a real problem to generate the code.

    I've got two V3s so I can safely try this out and I hope I can report back something positive.

    Now since I'm only doing Motomodding since a couple of weeks, it would be nice if one of the die hard modders can comment on this idea.

  2. 5 Users Say Thank You to jockyw2001 For This Useful Post

    adminzc (12-14-2008), Danation (11-06-2008), Dumba (06-19-2007), moond0ggie (06-19-2007), OCM (11-05-2008)

  3. #2
    milkbone98's Avatar
    offline Dont copy that floppy
    Join Date
    Oct 2006
    Location
    NY
    Posts
    7,784
    Thanks
    1,145
    Thanked 1,190 Times in 991 Posts
    Downloads
    406
    Uploads
    131
    Free PDS repair is a matter of trial and error in my experience. GOT and SmartClip are the best ways, but we know that they are not free. As far as using a different phones PDS and editing the IMEI contained within it, it sounds plausible to me.

  4. #3
    moond0ggie's Avatar
    offline Skilfull Modder
    Join Date
    May 2007
    Location
    Discovery Bay, Ca.
    Posts
    640
    Thanks
    130
    Thanked 166 Times in 134 Posts
    Downloads
    88
    Uploads
    0
    Thats the spirit!!!
    It's good to have a modder willing to experiment to help the community.
    I opened up a PDS backup in FB 2.62 Editor & found the ESN.
    The left column is hex, the right-? Look at 0011 also.
    There is also lots of Subsidy lock tables, don't know if they are serial # specific. Click on each hex # in far left column & it tells you what the seem is. I'll mess around with it a little also.
    Good luck!
    [IMG][/IMG]

  5. #4
    offline Maybe Modder
    Join Date
    Jun 2007
    Posts
    47
    Thanks
    9
    Thanked 21 Times in 13 Posts
    Downloads
    15
    Uploads
    0
    moond0ggie: you found the ESN, but what is it, never heard of it? Afaik we need to find the IMEI seem.

  6. #5
    moond0ggie's Avatar
    offline Skilfull Modder
    Join Date
    May 2007
    Location
    Discovery Bay, Ca.
    Posts
    640
    Thanks
    130
    Thanked 166 Times in 134 Posts
    Downloads
    88
    Uploads
    0
    ESN, sounds like it could be Electronic Serial Number,
    a unique identifier # assigned to each device.
    We are probably looking for any such #s that are unique, that can be changed to fit another phone.
    Heres some hex charts.

  7. The Following User Says Thank You to moond0ggie For This Useful Post:

    Dumba (06-19-2007)

  8. #6
    zedbra's Avatar
    offline Moderator
    Join Date
    Jun 2007
    Location
    Alternate Reality
    Posts
    2,175
    Thanks
    711
    Thanked 908 Times in 626 Posts
    Downloads
    309
    Uploads
    15
    Great work fellas, I too have been trying to change PDS info to match that of another phone this past week, but without luck. I think there is more than one area of the PDS that contains specific info toward any phones uniqueness. If by some fluke I find any useful data, i'll report it promptly!! Good Luck Men!!

  9. #7
    Dumba's Avatar
    offline Administrator
    Join Date
    Jan 2007
    Location
    Portugal
    Posts
    12,780
    Thanks
    5,149
    Thanked 5,445 Times in 3,380 Posts
    Downloads
    6
    Uploads
    0
    Got to tell you that the admins will not host any info about IMEI changing afaik, so please keep it clean. We all would also like to know in general how and if it works.

    Please do not kiss, or lick, the Monitor.

  10. The Following User Says Thank You to Dumba For This Useful Post:


  11. #8
    milkbone98's Avatar
    offline Dont copy that floppy
    Join Date
    Oct 2006
    Location
    NY
    Posts
    7,784
    Thanks
    1,145
    Thanked 1,190 Times in 991 Posts
    Downloads
    406
    Uploads
    131
    The ESN is the CDMA version of an IMEI. It is in either decimal (11 digit numerical) or hex (8 digit hex) format.

  12. 2 Users Say Thank You to milkbone98 For This Useful Post

    jockyw2001 (06-20-2007), moond0ggie (06-20-2007)

  13. #9
    Jack's Avatar
    offline Retired Moderator
    Join Date
    Oct 2006
    Location
    Boyce, Va
    Posts
    7,945
    Thanks
    920
    Thanked 2,049 Times in 1,056 Posts
    Downloads
    0
    Uploads
    0
    Quote Originally Posted by Dumba View Post
    Got to tell you that the admins will not host any info about IMEI changing afaik, so please keep it clean. We all would also like to know in general how and if it works.
    My friend is right. But its cool as long as its with the intent of repairing your own... no pirating, guys! LOL

    E is for Ezra and C is for Charley

  14. 2 Users Say Thank You to Jack For This Useful Post

    Danation (11-06-2008), Dumba (06-19-2007)

  15. #10
    offline Maybe Modder
    Join Date
    Jun 2007
    Posts
    47
    Thanks
    9
    Thanked 21 Times in 13 Posts
    Downloads
    15
    Uploads
    0
    First attempt failed

    I'm using F&B 3.05 for flashing and exporting/adding seems.

    I tried to repair phone1 by flashing it with the PDS of phone2 after I modified seems 0004 (IMEI) and 0079 (ESN) with the values of phone1.

    Well, I haven't given up yet

    EDIT1: To start of slowly, I modified PDS of phone1 with seem 0006 (PA_CALIBRATION) of phone2. Now phone1 powers up fine. That just proves that the concept of swapping seems can work.
    EDIT2: I modified PDS of phone1 with seem 0079 (ESN) of phone2. Now phone1 doesn't power up.

    My strategy will be to change just one seem at the time in the PDS of phone1 with the corresponding seem of phone2. Just to figure out which ones are essential for the phone to start up.
    Last edited by jockyw2001; 06-19-2007 at 05:39 PM.

  16. #11
    moond0ggie's Avatar
    offline Skilfull Modder
    Join Date
    May 2007
    Location
    Discovery Bay, Ca.
    Posts
    640
    Thanks
    130
    Thanked 166 Times in 134 Posts
    Downloads
    88
    Uploads
    0
    Keeping it clean,

    Just seeing if it's possible to repair a V3 w/ corrupt PDS & no back-up,
    by reconfiguring a PDS back-up from a different V3. No changing of IMEIs of the devices!

    Thanks for the heads up!
    Thanks for the info mb98
    Nice work jockyw
    Last edited by moond0ggie; 06-19-2007 at 09:20 PM.

  17. #12
    offline Maybe Modder
    Join Date
    Jun 2007
    Posts
    47
    Thanks
    9
    Thanked 21 Times in 13 Posts
    Downloads
    15
    Uploads
    0
    I sequentially copied all PDS seems from my black V3 to my silver V3 and verified which seems can and which can't be transferred. This time consuming experiment serves only one purpose: PDS repair for poor guys whose phone is bricked and who don't have a PDS backup.

    Summary of results
    56 seems in total in Black PDS and 54 seems in Silver PDS
    24 seems could not be transferred from Black to Silver PDS ('xx'): IMEI, ESN, 12x SUBSIDY_LOCK, INITIAL_PHONE_LOCK_CODE, SERVICE_PASSWORD, IN_FACTORY, 5x GLOBAL_PROTECT, 2x AIRTEL_LOCK, PRODUCT_SECURITY_VERSION
    32 seems could be transferred from Black to Silver PDS ('ok')

    Details
    Code:
    Black		Silver
    =====       ======
                      
    0001 ok     0001	PHASING_VERSION  
    0004 xx     0004  	IMEI
    0006 ok     0006  	PA_CALIBRATION
    000A ok     000A  	AGC_MINIMUM_PWR_LEVEL
    000B ok     000B  	AGC_TABLE
    000F ok     000F  	AFC_ADJUST
    0011 ok     ----  	FACTORY_SERIAL_NUMBER
    0016 ok     0016  	FACTORY_TRACKING
    0022 ok     0022  	RX_IQ_BALANCE
    0023 ok     0023  	MIC_GAIN
    0024 ok     0024  	HAPI_DTOA_PHASING_VALUES
    002F ok     002F  	HAPI_ATOD_PHASING_VALUES
    0030 ok     0030  	SBCM_BATT_THRSHOLD_OFFSET_DFLTS
    0031 ok     0031  	SBCM_MIDRATE_MIN_CALL_THRSHOLD
    003A ok     003A  	GSM_CHECKSUM
    003C ok     003C  	BATTERY_CHECKSUM
    005F xx     005F  	SUBSIDY_LOCK_GSM_HLR_TABLE
    0079 xx     0079  	ESN
    00AB ok     00AB  	SAM_LOCAL_DEVICE (Bluetooth BD_ADDR)
    0136 ok     0136  	SUBSIDY_LOCK
    0139 ok     0139  	DFLT_SUBSIDY_LOCK
    0145 ok     0145  	SBCM_BATT_DATA_DFLTS
    015B xx     015B  	SUBSIDY_LOCK_GSM_HPLMN_LIST
    015C xx     015C  	SUBSIDY_LOCK_GSM_SSCP
    015D xx     015D  	SUBSIDY_LOCK_GSM_NWSCP
    015E xx     015E  	SUBSIDY_LOCK_GSM_VALID_PLMN_LIST
    0161 xx     0161  	SUBSIDY_LOCK_GSM_SP_CODE
    0162 xx     0162  	OTA_SUBSIDY_LOCK_CODE
    0163 ok     0163  	DFLT_OTA_SUBSIDY_LOCK_CODE
    017B xx     017B  	SUBSIDY_LOCK_OTKSL_PASSWORD
    0181 ok     0181  	DFLT_DISPLAY_SETTINGS
    0184 xx     0184  	INITIAL_PHONE_LOCK_CODE
    0185 xx     0185  	SUBSIDY_LOCK_SOC_TABLE
    0186 xx     0186  	SUBSIDY_LOCK_BIT_AND_CLR_SSD_BIT
    0189 xx     0189  	SUBSIDY_LOCK_SECONDARY_SP_CODE
    01BB xx     01BB  	SERVICE_PASSWORD
    01C1 xx     01C1  	IN_FACTORY
    01C3 xx     01C3  	GLOBAL_FEATURE_PROTECTED_STATE_NVM
    01C4 xx     01C4  	GLOBAL_FEATURE_PROTECTED_STATE_DEFAULT_NVM
    01C5 xx     01C5  	GLOBAL_FEATURE_PROTECTED_VALUE_NVM
    01C6 ok     01C6  	GLOBAL_FEATURE_PROTECTED_VALUE_DEFAULT_NVM
    01C7 xx     01C7  	GLOBAL_PROTECTED_FLEX_TABLE
    01F8 xx     01F8  	AIRTEL_LOCK_CODES
    01F9 xx     01F9  	AIRTEL_UNLOCK_CODES
    01FA xx     01FA  	SUBSIDY_LOCK_3RD_SP_CODE
    0279 ok     0279  	ALL_EXT_DATA_SESS_TIME
    028B ok     028B  	FACTORY_HW_INFO (P600V600)
    02D2 ok     02D2  	BOOT_SW_VER (@(#)R374_G_0E.40.3ER_A)
    02D3 ok     02D3  	BOOT_FLEX_MODEL (@(#)SE8609AXXJ804C)
    02D4 ok     02D4  	?? (r3.7.4_razor_pds_001)
    02DB ok     02DB  	DESENSE_MFN_DELTA
    02DC ok     02DC  	DESENSE_CHANNEL_LIST
    02E7 xx     02E7  	PRODUCT_SECURITY_VERSION
    02F1 ok     02F1  	RSSI_OFFSET
    02F4 ok     02F4	RXLEV_REPORT_ENHANCEMENTS
    030F ok		----
    I will try a bit more on a PDS backup of zedbra. I hope to find a way to reset some of the critical seem areas (SUBSIDY_LOCK etc.)

  18. The Following User Says Thank You to jockyw2001 For This Useful Post:

    moond0ggie (06-20-2007)

  19. #13
    milkbone98's Avatar
    offline Dont copy that floppy
    Join Date
    Oct 2006
    Location
    NY
    Posts
    7,784
    Thanks
    1,145
    Thanked 1,190 Times in 991 Posts
    Downloads
    406
    Uploads
    131
    I wish you the best, this is good stuff.

  20. #14
    moond0ggie's Avatar
    offline Skilfull Modder
    Join Date
    May 2007
    Location
    Discovery Bay, Ca.
    Posts
    640
    Thanks
    130
    Thanked 166 Times in 134 Posts
    Downloads
    88
    Uploads
    0
    Yea jockyw,
    good job there, you must have had to hand enter all that!
    It will probably be a great benefit to have the two different PDS seem charts to compare side by side.
    If you discover a software PDS restoration technique, you'll be famous amongst all modders!


    Quote Originally Posted by A Modder
    "I Hard Bricked my Razr, but I Jockyed the PDS & flashed a MP, now all is good"
    Last edited by moond0ggie; 06-21-2007 at 01:23 AM.

  21. #15
    offline Maybe Modder
    Join Date
    Jun 2007
    Posts
    47
    Thanks
    9
    Thanked 21 Times in 13 Posts
    Downloads
    15
    Uploads
    0
    If anyone succesfully performed a PDS repair on a RAZR V3 please report here. I need to know which tool and version you used and whether you performed the function with or w/o Testpoint and with or w/o special hardware box (such as Smartclip).

    Thx in advance!
    Last edited by jockyw2001; 06-23-2007 at 09:19 AM.

Page 1 of 3 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •