NEW WAY OF TESTPOINT ON V3i(russian method)

[sharan_123]

here"S a method of testpointing v3i withoput opening ur phone.
thanks to dev.meena and maverick who converted it into english.
From what I understand we have to do this:

1. Open CG1 in a hex editor. Change the first four bytes to 00 00 00 00
2. Search for hex string: 12FE0000
Replace it with: 100049BC (For bootloader 0A.30).
Replace it with: 10004C78 (For bootloader 0A.52)
Its different for every bootloader. I will find for the other bootloaders later on.
3. RSA Patch the firmware if its not already RSA Patched. Testing has shown that this step is desirable. Ofcourse this would mean that you will need to get CG3, 7 and 18 with CG1 too.
4. Flash this patched and edited CG1+CG3+CG7+CG18 with P2k Easy Tools v3.9
5. After successful flashing and hence removal of firmware from your phone, remove battery and cable from your phone.
6. Now put in the battery and connect the cable. Your phone should be detected as S Blank Neptune LTE2. In other words it has been "soft" testpointed
7. To get the phone working again, reflash the phone with CG1+CG3+CG7+CG18 (not the one you edited in steps 1,2 and 3, but some other)

Do not use RSDLite for flashing here.
For those who don't understand, here are the autopatchers for doing step 1 and 2 for you:
For Bootloader 0A.30:
i have attached the bootloader in exe version.
Open CG1 in it and click on Start.
we are looking for some testers who can test this method on their v3i"s
this method has worked for one guy
"vermsky"

Originally Posted by vermsky
It worked for me. I have a V3i R47A. I used FB3.06 only. Here's what I did.

1. Backup CG1, CG3, CG7, CG18.
2. Remove RSA.
3. Flash RSA removed firmware back to phone using FB3.
4. Open CG1 in a hex editor. Change the first four bytes to 00 00 00 00
5. Search for hex string: 12FE0000
Replace it with: 100049BC (For bootloader 0A.30).
Replace it with: 10004C78 (For bootloader 0A.52)
6. Flash CG1 with FB3.

After step 6, I got critical error 84 shown on the phone and FB3 stopped and gave an error. I removed the battery and opened RSD. I powered on the phone and RSD showed S Blank. I guess I can call it a success.



NOTE: I did not use p2k easy tools 3.9 to revive my phone. So I cannot vouch for it to be able to revive your phone afterwards.

2nd Note: Phone is back to normal after flashing with Rocker Dongle.

[manas]

Nice guide

[sharan_123]

yeah,really nice but lookin for someone to test it

[BF]

I wonder if I could make that work for 0A.52 on L7

[sharan_123]

works
For Bootloader 0A.30:
For Bootloader 0A.52:
For Bootloader 08.A0:
For Bootloader 08.D0
For Bootloader 08.E0
For Bootloader 09.02

[BF]

Do you have the replace code for 08.D0 and 09.02?

A firmware reflash could be made for each bootloader. Just flash and you're Blank.

[sharan_123]

Do you have the replace code for 08.D0 and 09.02?

A firmware reflash could be made for each bootloader. Just flash and you're Blank.

i think ur looking for these

[BF]

Something is wrong with your data. Hex String 12FE0000 could not be found in R47A.A1R

Nevermind, they can use the Auto-Patcher, Thanks.

Would an 0A.52 L7 user please test this if you know what you're doing?

[aclark]

this will be great if it ends up working on 0A.52 and 09.02

[BF]

this will be great if it ends up working on 0A.52 and 09.02

I'll test the 08.D0 when I get my L7 back. He came by yesterday but i was sleep

[Clarkey]

b i'll test when i get home on my 08.D0

[BF]

Sharan, did you see one for 0A.20?

[sharan_123]

na

[BF]

na

Thanks for the AutoPatchers, it will make things much nicer for those bootloaders. If there are successes, I will try and port it to 0A.20, but I'm not finding that Hex value in any of the firmwares when I search for it. I'll patch an R47A V3i firmware, and do a compare to the stock one. It will discover the place and value of patching.

The 0A.52 patcher changes first four bytes to 0000 0000 and changes value 46C08820 to 10004C78

[Zephyr]

Trying it with my L7 08.D0 now.

I'll post back with the results when it's done.