PDS repair ideas

[jockyw2001]

The phone can be in any degree of bricked state, but as long as you have a backup of your PDS it can be brought back alive. We all know that, but it still happens that in our modding enthousiasm, we forget to make a backup or due to a harddisk crash we lose them.

So what to do in such cases? Some of us, myself included, try those fancy h*cked proggies which have this "PDS Repair" function. I tried many only to find my phone even more severely bricked afterwards. I have searched and read countless threads about it, but haven't found the ultimate solution yet. It seems the PDS repair function only works when you have the associated hw dongle such as the Smartclip.

I believe I now finally found something which is worthwhile to pursue. The idea is to take someone else's working PDS and then to change the IMEI seem in PDS such that it matches the IMEI which sits in your phone's read-only memory (OTP). As you will probably know, if you take someone else his PDS the phone will not start. This is because the firmware compares the PDS IMEI with the one in OTP. If the numbers don't match the phone will power off.

I found an interesting thread in gsmforum which describes the process of changing seem 0004 which apparently is a copy of the OTP IMEI. The number is scrambled a bit, but it shouldn't be a real problem to generate the code.

I've got two V3s so I can safely try this out and I hope I can report back something positive.

Now since I'm only doing Motomodding since a couple of weeks, it would be nice if one of the die hard modders can comment on this idea.

[milkbone98]

Free PDS repair is a matter of trial and error in my experience. GOT and SmartClip are the best ways, but we know that they are not free. As far as using a different phones PDS and editing the IMEI contained within it, it sounds plausible to me.

[moond0ggie]

Thats the spirit!!!
It's good to have a modder willing to experiment to help the community.
I opened up a PDS backup in FB 2.62 Editor & found the ESN.
The left column is hex, the right-? Look at 0011 also.
There is also lots of Subsidy lock tables, don't know if they are serial # specific. Click on each hex # in far left column & it tells you what the seem is. I'll mess around with it a little also.
Good luck!
[IMG][/IMG]

[jockyw2001]

moond0ggie: you found the ESN, but what is it, never heard of it? Afaik we need to find the IMEI seem.

[moond0ggie]

ESN, sounds like it could be Electronic Serial Number,
a unique identifier # assigned to each device.
We are probably looking for any such #s that are unique, that can be changed to fit another phone.
Heres some hex charts.

[zedbra]

Great work fellas, I too have been trying to change PDS info to match that of another phone this past week, but without luck. I think there is more than one area of the PDS that contains specific info toward any phones uniqueness. If by some fluke I find any useful data, i'll report it promptly!! Good Luck Men!!

[Dumba]

Got to tell you that the admins will not host any info about IMEI changing afaik, so please keep it clean. We all would also like to know in general how and if it works.

[milkbone98]

The ESN is the CDMA version of an IMEI. It is in either decimal (11 digit numerical) or hex (8 digit hex) format.

[Jack]

Got to tell you that the admins will not host any info about IMEI changing afaik, so please keep it clean. We all would also like to know in general how and if it works.

My friend is right. But its cool as long as its with the intent of repairing your own... no pirating, guys! LOL

[jockyw2001]

First attempt failed

I'm using F&B 3.05 for flashing and exporting/adding seems.

I tried to repair phone1 by flashing it with the PDS of phone2 after I modified seems 0004 (IMEI) and 0079 (ESN) with the values of phone1.

Well, I haven't given up yet

EDIT1: To start of slowly, I modified PDS of phone1 with seem 0006 (PA_CALIBRATION) of phone2. Now phone1 powers up fine. That just proves that the concept of swapping seems can work.
EDIT2: I modified PDS of phone1 with seem 0079 (ESN) of phone2. Now phone1 doesn't power up.

My strategy will be to change just one seem at the time in the PDS of phone1 with the corresponding seem of phone2. Just to figure out which ones are essential for the phone to start up.

[moond0ggie]

Keeping it clean,

Just seeing if it's possible to repair a V3 w/ corrupt PDS & no back-up,
by reconfiguring a PDS back-up from a different V3. No changing of IMEIs of the devices!

Thanks for the heads up!
Thanks for the info mb98
Nice work jockyw

[jockyw2001]

I sequentially copied all PDS seems from my black V3 to my silver V3 and verified which seems can and which can't be transferred. This time consuming experiment serves only one purpose: PDS repair for poor guys whose phone is bricked and who don't have a PDS backup.

Summary of results
56 seems in total in Black PDS and 54 seems in Silver PDS
24 seems could not be transferred from Black to Silver PDS ('xx'): IMEI, ESN, 12x SUBSIDY_LOCK, INITIAL_PHONE_LOCK_CODE, SERVICE_PASSWORD, IN_FACTORY, 5x GLOBAL_PROTECT, 2x AIRTEL_LOCK, PRODUCT_SECURITY_VERSION
32 seems could be transferred from Black to Silver PDS ('ok')

Details

Black		Silver
=====       ======
                  
0001 ok     0001	PHASING_VERSION  
0004 xx     0004  	IMEI
0006 ok     0006  	PA_CALIBRATION
000A ok     000A  	AGC_MINIMUM_PWR_LEVEL
000B ok     000B  	AGC_TABLE
000F ok     000F  	AFC_ADJUST
0011 ok     ----  	FACTORY_SERIAL_NUMBER
0016 ok     0016  	FACTORY_TRACKING
0022 ok     0022  	RX_IQ_BALANCE
0023 ok     0023  	MIC_GAIN
0024 ok     0024  	HAPI_DTOA_PHASING_VALUES
002F ok     002F  	HAPI_ATOD_PHASING_VALUES
0030 ok     0030  	SBCM_BATT_THRSHOLD_OFFSET_DFLTS
0031 ok     0031  	SBCM_MIDRATE_MIN_CALL_THRSHOLD
003A ok     003A  	GSM_CHECKSUM
003C ok     003C  	BATTERY_CHECKSUM
005F xx     005F  	SUBSIDY_LOCK_GSM_HLR_TABLE
0079 xx     0079  	ESN
00AB ok     00AB  	SAM_LOCAL_DEVICE (Bluetooth BD_ADDR)
0136 ok     0136  	SUBSIDY_LOCK
0139 ok     0139  	DFLT_SUBSIDY_LOCK
0145 ok     0145  	SBCM_BATT_DATA_DFLTS
015B xx     015B  	SUBSIDY_LOCK_GSM_HPLMN_LIST
015C xx     015C  	SUBSIDY_LOCK_GSM_SSCP
015D xx     015D  	SUBSIDY_LOCK_GSM_NWSCP
015E xx     015E  	SUBSIDY_LOCK_GSM_VALID_PLMN_LIST
0161 xx     0161  	SUBSIDY_LOCK_GSM_SP_CODE
0162 xx     0162  	OTA_SUBSIDY_LOCK_CODE
0163 ok     0163  	DFLT_OTA_SUBSIDY_LOCK_CODE
017B xx     017B  	SUBSIDY_LOCK_OTKSL_PASSWORD
0181 ok     0181  	DFLT_DISPLAY_SETTINGS
0184 xx     0184  	INITIAL_PHONE_LOCK_CODE
0185 xx     0185  	SUBSIDY_LOCK_SOC_TABLE
0186 xx     0186  	SUBSIDY_LOCK_BIT_AND_CLR_SSD_BIT
0189 xx     0189  	SUBSIDY_LOCK_SECONDARY_SP_CODE
01BB xx     01BB  	SERVICE_PASSWORD
01C1 xx     01C1  	IN_FACTORY
01C3 xx     01C3  	GLOBAL_FEATURE_PROTECTED_STATE_NVM
01C4 xx     01C4  	GLOBAL_FEATURE_PROTECTED_STATE_DEFAULT_NVM
01C5 xx     01C5  	GLOBAL_FEATURE_PROTECTED_VALUE_NVM
01C6 ok     01C6  	GLOBAL_FEATURE_PROTECTED_VALUE_DEFAULT_NVM
01C7 xx     01C7  	GLOBAL_PROTECTED_FLEX_TABLE
01F8 xx     01F8  	AIRTEL_LOCK_CODES
01F9 xx     01F9  	AIRTEL_UNLOCK_CODES
01FA xx     01FA  	SUBSIDY_LOCK_3RD_SP_CODE
0279 ok     0279  	ALL_EXT_DATA_SESS_TIME
028B ok     028B  	FACTORY_HW_INFO (P600V600)
02D2 ok     02D2  	BOOT_SW_VER (@(#)R374_G_0E.40.3ER_A)
02D3 ok     02D3  	BOOT_FLEX_MODEL (@(#)SE8609AXXJ804C)
02D4 ok     02D4  	?? (r3.7.4_razor_pds_001)
02DB ok     02DB  	DESENSE_MFN_DELTA
02DC ok     02DC  	DESENSE_CHANNEL_LIST
02E7 xx     02E7  	PRODUCT_SECURITY_VERSION
02F1 ok     02F1  	RSSI_OFFSET
02F4 ok     02F4	RXLEV_REPORT_ENHANCEMENTS
030F ok		----

I will try a bit more on a PDS backup of zedbra. I hope to find a way to reset some of the critical seem areas (SUBSIDY_LOCK etc.)

[milkbone98]

I wish you the best, this is good stuff.

[moond0ggie]

Yea jockyw,
good job there, you must have had to hand enter all that!
It will probably be a great benefit to have the two different PDS seem charts to compare side by side.
If you discover a software PDS restoration technique, you'll be famous amongst all modders!

"I Hard Bricked my Razr, but I Jockyed the PDS & flashed a MP, now all is good"

[jockyw2001]

If anyone succesfully performed a PDS repair on a RAZR V3 please report here. I need to know which tool and version you used and whether you performed the function with or w/o Testpoint and with or w/o special hardware box (such as Smartclip).

Thx in advance!