How I Killed BL 8.29.

**flaterik** · 09-23-2009, 02:44 AM

I'm trying this right now, but I'm having an issue on the second step (the downgrade).

Forgive ignorance, this is my first attempt at mucking with a razr. I took it upon myself to unlock a v3 which happened to have 8.29 on it.

I can Test Point just fine - both F&B3 and RSD respond as expected. But I always get some sort of error when I try to do the downgrade.

What I'm doing is connecting the TP pin to ground, connecting, waiting for "device connected", and then following the F&B3 steps. When I get to 19, I get and error at the "erasing memory" step.

I'm using a windows 7 pre-release which might be my problem, as I've read somewhere that people have had trouble with Vista and F&B. My only other windows boxes are Vista, so I HOPE it's not an OS issues. Any ideas?

Regardless, thanks for the excellent info on this forum.

I lied; I'm getting at error at "sending the loader" portion in F&B.

**alaminok** · 09-23-2009, 02:48 AM

did you overcome testpoint ????

**flaterik** · 09-23-2009, 03:00 AM

As far as I know I have overcome testpoint. Connect lower portion to battery without short = "unknown USB device". connect lower to battery with short = "connected to device" in F&B.

(after replacing a power switch on an iPhone, pulling apart a razr and shorting one pin is child's play)

**butterjoe** · 09-23-2009, 10:50 AM

I used Windows server 2003 which is like XP. I dont know if win 7 causes issues or not. Can you post screen shots of the error? You can also copy and paste the text from the windows during the process.

**flaterik** · 09-23-2009, 04:51 PM

I tried again with my Vista machine at work, and this is what I'm getting:

------------------------------------------------------

*** Operation start (9/23/2009 2:03:14 PM) ***
Flash&Backup 3.0.7
Write data: C:\Users\enelson\AppData\Local\Temp\fb3\~quickflas h\qflash.f3u

Sending the loader...
Error!
Executing JUMP...
Done.
Erasing memory... (Progress of this process is not shown)
Error!
Sending code group: CG5
Error!
Sending code group: CG8
Error!
Operation done.

*** Operation end (9/23/2009 2:03:49 PM) ***

Oddly I just tried again, and when I did TP and connected power, F&B3 said phone connected and listed the full phone info, rather than just saying "phone connected" like it has before. It seemed to hang on the Write data: C:\Users\enelson\AppData\Local\Temp\fb3\~quickflas h\qflash.f3u step though, and didn't go to "sending loader" until I let the battery disconnect. I'll try a couple more times, but that log is exactly what I was getting at home on my Windows 7 machine.

Okay more info.

- I successfully got n00b MP on following the beginning of the guide. When put together the phone boots normally and seems to work fine with an at&t sim.
- I wasn't sure if it was just EVERYTHING being borked, so I tried a backup with F&B. Oddly the backup seemed to work, even though there was error with the loader again:

------------------------------------------------------

*** Operation start (9/23/2009 3:32:20 PM) ***
Flash&Backup 3.0.7
Read data: C:\Program Files\Motorola Tools\Flash&Backup 3\Backups\2009-09-23_153220\...

Sending the loader...
Error!
Executing JUMP...
Done.
Reading the code group: CG1
Done.
Reading the code group: CG2
Done.
Reading the code group: CG3
Done.
Reading the code group: CG4
Done.
Reading the code group: CG15
Done.
Reading the code group: CG18
Done.
Creating the SHX file...
Operation done.

*** Operation end (9/23/2009 3:39:21 PM) ***

And just to double-triple check that I'm doing this right: TP is only expected to work as long as I've got the phone connected to power, and I should be attempting to flash while I'm holding together the disassembled phone? Because if I just do the test point, and start with #/* to get in loader mode, I get a critical error on the phone when attempting to flash.

Thanks again.

**butterjoe** · 09-23-2009, 05:57 PM

yes that is correct you have to keep power throughout the flashing.

Now you can go through the process of downgrading the boot loader next.

And don't worry about the error if everything else goes ok.

**flaterik** · 09-23-2009, 06:23 PM

That first log I sent is from I attempt to flash R374_V3BL 07.D0.shx with RMDDLD V3_RAMDLD_827_03FD0000.ldr.

I've held the phone to power for what feels like quite a while after
---
Sending the loader...
Error!
Executing JUMP...
Done.
Erasing memory... (Progress of this process is not shown)
Error!
Sending code group: CG5
---

And the progress bar never starts. I'll try to hold it there for a full couple of minutes, but it seems like all of the other times the code group send or receive started right away.

**butterjoe** · 09-23-2009, 06:43 PM

Try TP again and reflash file it should not take that long to send the CG groups

notice the time it took with mine:
*** Operation start (8/8/2009 10:17:13 PM) ***
Flash&Backup 3.0.7
Write data: C:\Documents and
Settings\Administrator.SERVER\Desktop\Moto_V3&V3X_ Unlocker BY
BIGTREES0\V3_Unlock\R374_V3BL_07.D0\R374_V3BL 07.D0.shx

Extracting data from firmware file...
Sending the loader...
Done.
Executing JUMP...
Done.
Erasing memory... (Progress of this process is not shown)
Done.
Sending code group: CG5
Done.
Sending code group: CG8
Done.
Operation done.

*** Operation end (8/8/2009 10:17:26 PM) ***

**flaterik** · 09-23-2009, 07:54 PM

Well I done did SOMETHING. I flashed 7d0 from PT, and it seemed to go okay... I then did an unlock, which said it worked. But now... phone seems rather brickish. Grr.

I've tried several restores - writing the n00b back, writing out the backup I made earlier, but the phone won't turn on normally. I can start it with #/* and I get a blank screen, but plugged into RSD I get this output:

IMEI/ESN/MEID: N / A
Technology: N / A
Software Version: R374_G_0E.42.17R
Flex Version: GSMV3xxT677GA164
Bootloader Version: v0x0007D0
DRM Version: N / A
Phone Type: Production (0B2F1160090F09166FFD00000000)

I'm going to keep poking at it myself, but does anyone have any unbricking advice?

Okay, this post
http://www.modmymoto.com/forums/showthread.php?t=441061

describes exactly what I'm seeing - if I start the phone and immediately close it, it will stay on, but I just get a blank white screen if I open it. That post seems to have the solution, but... I can't find the NOFLIP bootloader anywhere. There doesn't seem to be any googleable reference to it anywhere except that post!

Anyone?

**butterjoe** · 09-23-2009, 07:57 PM

You might have to try a different 7D.0 sometimes when flashing 7.D0 it makes the flip work opossite eg. flip closed after power button press phone boots but cl.gif pic is upsidedown/ flip open power button pressed blank screen or blank screen but when flip closed image appears on outside screen also at this point if you open flip slightly lcd is lit and showing picture. Does this apply to you? or is it not just coming on.

**flaterik** · 09-23-2009, 08:13 PM

yeah that sounds like what's going on - when the phone is closed I have "got n00b?" on the outer screen upside down, and when it's open I have a blank white main screen with the normal "insert sim" screen on the outer screen.

I used the 7D0 from the bootloader pack to get this far. The only other 7D0 I see anywhere is the R374_V3BL 07.D0.shx, which so far I've never been able to flash. Is there another 7D0 somewhere else I can try?

Thanks for all the help!

---
Aha! TestPoint+Flashing R374_V3BL 07.D0.shx without cahnging the DLD worked! Got another error on Sending the Loader, but the phone starts up normally now!

Is there any way to verify unlockedness other than a non-carrier SIM? I don't have the sim this phone was being unlocked to use (it's for someone else. yes, a girl. yes, she's already my girlfriend.)

**butterjoe** · 09-23-2009, 08:23 PM

Originally Posted by flaterik

yeah that sounds like what's going on - when the phone is closed I have "got n00b?" on the outer screen upside down, and when it's open I have a blank white main screen with the normal "insert sim" screen on the outer screen.

I used the 7D0 from the bootloader pack to get this far. The only other 7D0 I see anywhere is the R374_V3BL 07.D0.shx, which so far I've never been able to flash. Is there another 7D0 somewhere else I can try?

Thanks for all the help!

---
Aha! TestPoint+Flashing R374_V3BL 07.D0.shx without cahnging the DLD worked! Got another error on Sending the Loader, but the phone starts up normally now!

Is there any way to verify unlockedness other than a non-carrier SIM? I don't have the sim this phone was being unlocked to use (it's for someone else. yes, a girl. yes, she's already my girlfriend.)

Great! That is good news! Glad it worked. Yes the only time you need to use the ldr and TP is for the initial MP and BL downgrade after that isn't needed you will be able to flash anything freely.

The only way I know is to have a sim from a different carrier to test it out other than that If you used a cracked version of p2K Tools it should now be unlocked.

Congrats on your success

. Your girlfriend will think your King

now. Don't forget to hit the thanks button.

**xingfushi** · 10-29-2009, 08:54 PM

thank you very much.

**butterjoe** · 11-02-2009, 12:00 AM

Originally Posted by xingfushi

thank you very much.

your welcome

**xingfushi** · 11-16-2009, 05:19 PM

I tried to use FB3 to backup, but it always failed. The error code 12 01. Why this happened? Anyone can help me? Best regards.

Thread: How I Killed BL 8.29.

LinkBack

Thread Tools

Display

The Following User Says Thank You to butterjoe For This Useful Post:

The Following User Says Thank You to flaterik For This Useful Post:

The Following User Says Thank You to butterjoe For This Useful Post:

2 Users Say Thank You to butterjoe For This Useful Post

Posting Permissions