Thursday, August 18, 2005

 

Hacking the Motorola E815 (part 1)

At 3:30AM this morning, and after several days of effort, I finaly succeeded with performing unsupported modifications to my new cellphone.

If you are a proud owner of a new generation Motorola cellphone and/or a sad Verizon customer, the following information may come in handy.

First of all, credit where credit is due:  I could not have pulled this off without Justyna--it was truly a team effort.  When I was hopelessly stuck and feeling like a dumb geek, Justyna figured out the necessity of PST and the
crucial importance of orderly driver loading.  I estimate that Justyna gave up at least an hour or two of good prime time television to figure these things out.  I dedicate this successful hack to Justyna.  She may not understand binary math, but she is certainly a better problem solver than I am.
Anyway, here is how to unlock your Motorola phone and/or stick it to Verizon:

1. For the Motorola E815, I strongly recommend starting with Nuclear Elephant's E815 white paper.  He also has a similar fact sheet for the v710, the E815's crippled kid sister.  These instructions contain some errors and omissions, but are probably the most accurate and concise Motorola hacking instructions on the net.

2. Save money and buy your data cable from e-Bay.

3. You'll find a good p2k seem editor and the complete set of drivers for your phone at Inetron.  You can follow the Nuclear Elephant instructions to use these files.

4. As Justyna discovered (and the Nuclear Elephant and most other fact sheets gloss over or omit entirely) the Motorola PST phone programming tool is crucial.  You must have this program running in order to save your seem edit back to your phone.  You'll need a late-edition version of PST for your late-edition phone.  I can't tell you here how to get this program or Motorola will break my legs.  (Just ask me instead, or find it yourself on the Internet.)  PST must be runningbefore you open your seem editor.  But the good news is that if everything works, you don't have to put your phone into suspend mode and PST will trigger the autoload of the necessary USB drivers (if they aren't loaded already).

5. Correct driver loading is also critical, and this was one of the last issues I had to work out.  The first driver you load when you plug your phone into the data cable should be the "Motorola USB Modem" driver. After you start PST for the first time, but before you open p2k (important!) you will be prompted to load four more drivers.  You don't want to screw this up, so have the driver files for your phone already saved on your hard drive in a familiar location before you get to this step.

6. Don't be intimidated by the hexidecimal counting system while doing your seem edit.  Just remember it's 0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F (not 1-10).  If all else fails you should be able to find an already modded seem file at Inetron.

7. If you are using Mobile Phone Tools (usually included with your OEM phone data cable) you must update it up to version 3.25b in order to utilize Multimedia Studio and move your files back and forth between your computer and your phone.  Note that the update feature will probably not work from behind a corporate firewall, but if you look hard enough you can find fully updated copies of ver. 3.25b on the Internet.

8. Once your seem edit is complete and you have saved your changes to your phone, you don't have to pop the battery like many of the instructions online suggest.  Save yourself time and agravation and just click the "reset phone" button in the p2k seem editor.

9. If you are using the e815 and wondering why your successful seem edits still don't allow you to use Multimedia Studio in Mobile Phone Tools, it is because all of the online instructions are lacking a critical final instruction:  Change the communication settings in Mobile Phone Tools to manually specify the e815m (not the e815) as your modem of choice.  This will make the Multimedia Studio icon appear.

Anyway, now my phone is unshackled and fully capable of the features Verizon tried to keep from me:  free file sharing, MP3 ringtones, free proxy web browsing (maybe), and of course Bluetooth OBEX file transfers.

I bask now in my supreme geekiness (and also Justyna's)!




Comments:
I am pleased to announce that this has been my most-Googled blog post to date.

It heartens me that so many people are interested in getting around money-grubbing Verizon by unlocking their Motorola e815 phones.

I encourage any interested people reading this post to visit the Nuclear Elephant for instructions and Inetron for software to start hacking their phone.

I've been a very happy Verizon customer since I successfully turned on Bluetooth OBEX on my e815.
 
FIRST, I REALLY APPRECIATE YOUR INFO HERE AS WELL AS THE OTHERS WHO HAVE CONTRIBUTED TO THIS INFORMATION.

IT IS NICE TO SEE YOUR WEB SITE..... WISH YOU HAD A LITTLE MORE INFO FOR US BEGINNERS...

THIS IS MY BRIEF UNDERSTANDING FROM "NUCLEARELEPHANT" BUT I HAVE NEVER DONE THIS BEFORE (I AM WORRIED A LITTLE AS I DO NOT WANT TO CRASH MY PHONE), AND PROBABLY WILL HAVE DUMB QUESTIONS AND COMMENTS BELOW.....

Help or Comments is Appreciated!!!

[[ My Summary ]]:

Ok, my bitch at Verizon........ I was with T-mobile and my V300 worked great. I could upload and download everything with my Data Cable and software.

My own ring tones I made on my computer, my pictures, etc...... My contract ended and I liked the options of the E815 which is very close to my V300, and the coverage of Verizon seemed better than T-mobile. I thought all was fine and this is the phone i wanted.

[[Never]] did Verizon tell me that I could not upload my files/pics, etc.... directly from the Data Cable on their phones, I believed i could do the same things as on my V300, BOY WAS I WRONG!

I contacted Motorola and received an e-mail stating that Verizon (intentionally) had Moto set the phone up this way.

To me, I feel like Verizon pulled a very big scam!!! They want you to pay for every little function or ability on your phone that you just "bought". This is "my phone"......... I should be able to do what i want with it.

I am only using the Verizon system for the communication feature, but the phone is mine!!!

I searched and also found I could use a Card Reader/Writer with the T-Micro memory and do the same thing, but this would cost me another $ 90.00, to do what I did with my V300 at no extra expense.

I bought the Card 18in1 Card Reader/Writer (as it will come in handy anyway for other uses)....

This is what lead me to start searching and found your web site as well as a few others.

*******

After reading various [Post] I was able to obtain the following:

P2K Software/Seem (the newer version which has the default of 41A already set), the E815 Drivers and the Motorola software "RSD v3.7.1"

** Questions:Is this RSD software the same as the PST?

I also found a place to obtain the PST v. 7.2.3 which I was told is better....but it stated below it is [NOT] needed if you have the P2K software.

I already have my Data Cable and Software, but the Data Cable is not from Motorola...I am willing to buy the Motorola Data Cable just to be safe as you and Nuclear Elephant indicated is desireable. I do not know what the difference is, but I am willing to spend a few dollars to buy the factory Data Cable.

Your Post on Hacking the Motorola E815 (part 1),on step 9 (changing the modem driver to E815m) works fine with my phone and setup with that option is very easy as you described in Step 9.

*** Note: In Reading Nuclear Elephant.com's info in Step #1, he indicated that when the handset is in the "suspend" mode you may be asked to install additional drivers...."there will be 4 or 5 drivers".

For us beginners it would be nice to know (at least list) the names of the device drivers so as to know what to watch for, and/or wheher or not I am installing the correct drivers.

In my computer I have 3 locations of drivers....... 1st and original is under my back-up V300 folder. the 2nd set is in my folder with the P2K seem and the RSD software, and the [Current] set is under the folder:

C:\programfiles\motorola\motorola phone tools\inf

which has the latest drivers and updated software from Motorola via internet download.... it is the Motorola Phone Tools ver. 4x

******

Ok, here is the break down on what Nuclear Elephant said in his bogg and what i am trying to understand:

INFO:

You'll first need a Motorola USB Data Cable and some software. Buy the OEM cable which includes a port to connect the AC adapter.

[Quoted] The Motorola PST software used to be required in order to set the handset into a diagnostic state,but it is

"no longer required"

If you follow his instructions below. The P2K Seem tool is actually what you'll use to make modifications to the handset, after you place the phone into suspend mode.

*****

The first thing to do is get the handset recognized by your PC and load the E815 drivers. There are two sets of devices your PC will recognize - one when the E815 is in standard operating mode, and another set of devices (including the Motorola test and command interfaces) when the device is in a suspended diagnostic mode.

1). Attach the E815 to the USB cable and your PC.

2) Windows XP will immediately recognize the handset and prompt you for drivers.

3) Direct the install program to the proper folder containing the drivers or your CD-ROM (if there).

Once you have the drivers installed, you must place the phone into 'Suspend Mode'.
This brings up Motorola's diagnostic interfaces and allows P2K Seem to identify your handset.

4) To bring up the suspend mode:
Type Menu + 0 + HUBME + *
Menu,then (048263*)into the set.

5) You will be given a prompt for an OpCode. Type in 54* and press OK.

The screen will immediately dim. Press the camera button on the outside of your handset to turn the backlight back on (this is the top right button on your E815 phone).

You should see 'SUCCEED'. Your handset is now suspended.

CAUTION: DO NOT CLOSE THE FLIP!

You may now be prompted to install additional Motorola drivers. There will be a total of four or five different drivers to install.

* Note: this is where I commented above.... it does not specify which drivers to install, and do I have to uninstall these drivers later or revert back to the original drivers? Do I just use these new drivers permanently?

What about Windows XP recognizing the driver change and trying to revert back to the original files (if Windows drivers are changed to protect itself?) Are we just dealing with Moto drivers only?

He also says:
**NOTE: If you are planning on using your E815 on a Macintosh, this is all fine and dandy (the OBEX mod does work on Mac), but you will need to make these initial modifications on a PC.

Once you've set up your USB drivers, you're ready to start modding "Seem data". The P2K Seem tool transfers seem data to/from your handset. In order to use the tool at any time, you'll first need to put your handset into the proper diagnostic mode.
(As indicated in the above instructions).

When you [close] the flip or [power cycle] the handset, the phone will be returned to a normal operating mode.

** So at this point he is saying if I "chicken out" on the mod, and while the phone is in the diag or suspend mode I can just close the lid or restart the phone and it will return to normal without data corruption, correct ?

6). You should hear one USB device disconnect and three more connect (when the phone is connected via USB, yes?).

*** Comment: yes, you normally hear one sound for connect-disconnet on the USB devices, but what are the "3" more connects about ?????? Is it the P2K software ??

7). Now fire up the P2K Seem tool. You should see "Connected" at the bottom of the screen.

If your phone does not connect, try disconnecting and reconnecting the handset from the USB cable; or, as a last resort try powering down the handset and re-initiating a suspend.

****

Once connected, P2K (Advanced P2K Seem Edit (SD)) Seem will already be configured to "SEEM" 41A , which is the feature seem of the Motorola v710 (the E815's crippled kid sister), as he stated.

HELP:

*** In the P2K software window you will see a label called "LOAD". Just below that there is another box called "SEEM", and to the right of that there is another box called "RECORD".

I am assuming that the "Record" is the state of the specific file or seem? If I am using the correct
terms. The "Record" set to zero (0) means it is in a "turn off" state, and the "Record set to One (1) is a "turn ON" state ????

Also, to the [right side] of the P2K window you will see the Byte (H) box... (H) I assuming means Hex (i.e. 7A) for the value.

** BEFORE THE NEXT STEP, THEY SAY TO BACK UP YOUR DATA TO A DISK OR YOUR COMPUTER (IT SAYS). I SAW A FEW OPTIONS AT THE BOTTOM OF THE P2K SOFTWARE FOR FILE TRANSFER... USE THE "READ FROM PHONE", THEN IN THE NEXT WINDOW "SAVE TO FILE"......

It then says to:

8). Change "SEEM" 41A to "SEEM" 2742, which is the correct value for the E815.

9). Change the Bytes (H) field from 7A to 90.

*****

You can use the [SEEM] 2742 chart below (thanks to Nuclear Elephant) to determine which features you want to enable/disable. Simply locate the correct byte in the file and click on it.

For example, if you want to edit byte 6A, count from "60". Hexadecimal counts in this order: 0 1 2 3 4 5 6 7 8 9 A B C D E F. When you click on the byte, you'll see a list of "bits" underneath the data window.

My Comment:

This is confusing. I remember the old days (like 25+ years ago) with Hex (Base 16), Octal (Base 8), Binary (Base 2 -- On or Off), and even doing convestion from one to another, but that was toooooo long ago. I cannot remember all this stuff and I do not understand the above edit stuff about Byte 6A, count from "60".

What is he talking about here. I understand how Hex counts above but that is about it. I do not remember how it all comes into
play aside from it pertains to a memory / function location, etc...


In looking at the list:

* I want to turn on my MultiMedia Studio on my E815 (like I had on my V300) to be able to upload and download my ring tones and pics via my USB Data cable.

So, is he saying set "Byte(H)" to 6A in the P2K software, with the "SEEM" 41A.

What is confusing is the chart below from him is the 6A is listed as an "Offset", under the "Offset/Bit", not in a coloumn as "Byte".

Next, goto the lower left side of the P2K software program under "Select Byte Detail" and put a [X] or check mark in the Bit "0"

(Note: I see Bit One(1) through Bit Seven (7), under the "Offset").
Again, is he saying we put an "X" or check mark on Bit Zero (0), Make Byte(H) 6A in the box , Make sure the "SEEM" is set to 41A ?

But how do you "Turn-On" the function? Is that what the "RECORD" box on the lower right side of the P2K program is for ????

So when i set up the above parameters the "Record" box will show a [Default] of zero (0) in the box which was set by Verizon or Motorola ????? And i need to set it to a value of "One" (1) ?

*****

He continues saying:

Once you have finished screwing around, you might want to save your new modded seem to disk; make sure you save it as a different filename from the original.

Finally, when you're ready, click 'Save to Phone' and the new data will be written. You will need to restart your phone for the changes to take effect. It's recommended that you yank the battery just to be sure nothing attempts to write to that memory area on shutdown. I heard you really do not need to "yank" the battery vs. a Normal shutdown or reboot..but I do not know.

******

NOTE says: If you've used ##DIALUP to enable dialup networking on the E815, you may need to re-enable it after making your seem edit.

I am not, or least not aware, that I am using Dial-up Networking (on the phone). That is fine to set up on your computer..if you are using it vs. a Cable Modem.

But here I am assuming he means if someone wanted to use his cell phone for Dial-Up networking from his computer ?????? I am not sure, please explain -----

*****

Crashing Your Phone (he states):


If you have the USB cable with a charge port, you should be able to recover from most problems, The E815 interfaces are alive when the phone is off and charging, so if you hose the phone perform these steps:


A) Pull the battery
B) Re-Insert the battery
C) Leaving the phone off, plug in the charge cable to your USB adapter and plug the USB adapter into your PC (this, of course, requires that you have a USB cable with a charge port).

You should be able to boot Motorola PST and connect to your interface to restore the original files/seems you hosed.

**** So here, it is important to have the Moto PST version 7.2.3 ?? Even though he said you do not need it for the modification of your E815, just nice to have to recover your phone ? As I indicated I can get the software, so it sounds like I should have it on hand for emergencies????

****

[SEEM] Mapping Table (Thanks to Jonathan):

The following represents seem elements which have been discovered and tested on the E815.
To submit an element,please notify jonathan@nuclearelephant.com with complete details.

[Seem] [Rec] [Length] [Offset/Bit] [Values Description] [Miscellaneous Paramenters (41A on V710)]
__________________________________________________________________________________________

2742 1 90 (?)

0A / 7 (1=On, 0=Off)
Phone Option: Menu Item: Settings > Initial Setup > Backlight > Continuous Dims Backlight instead of shutting off

24 / 2 (1=Enable, 0=Disable)
Phone Option: Press and Hold 1 > Autodial Voice Mail Number

5F / 5 (1=On, 0=Off)
Phone Option: Menu Items: Camera > Picture Setup > Counter

5F / 6 (1=On, 0=Off)
Phone Opton: Menu Items: Video Setup > Allow Alert

5F / 7 (1=On, 0=Off)
Phone Option: Menu Items: Video Setup > Video Quality

60 / 4 (1=On, 0=Off)
Phone Option: Menu Items: Camera/Video > Setup > Exposure

62 / 5 (1=On, 0=Off)

Phone Option: Menu Item: Messaging > Message Settings > PIX Message Setup > New / Edit / Delete Enables editing of PIX servers

65 / 5 (1=On, 0=Off)
Phone Option: Menu Items: Phonebook > Menu > Send, Pictures/Video > Menu > Copy > Bluetooth Not Supported (Yet)

6A / 0 (1=Enabled, 0=Disabled)
Phone Option: Enable Bluetooth OBEX Profile (and Media Transfer via Multimedia Studio / Mobile Phone Tools)

6A / 3 (1=On, 0=Off)
Phone Option: Menu Item: Security > Data Connection Change 1XRTT Auth Settings and Service Type (QNC, Packet, Auto)

6F / 7 (1=On, 0=Off)
Phone Option: Menu Item: Hidden Setup Menu > GPS Settings Basic Menu (Hide when enabling advanced menu)

71 / 5,6,7
72 / 0,1,2 (1=On, 0=Off)
Phone Option: Menu Item: Hidden Setup Menu > GPS Settings Enable Advanced GPS Settings Menu

75 / 5 (1=Enable, 0=Disable)
Phone Option: Enable Copy/Move To/From Transflash Options


****************

Well, I throw it your way for any thoughts......... Am I on the correct track ? It sound complicated but also sound simple....... I just need to understand a

little bit more....

Thanks,

Norm
 
One more comment-correction on my E815 and using the P2K software:

On the first post it talked about changing Byte(H)7A to 90, change "SEEM from 41A to 2742 for the (E815), and put a check mark in the box for Bit One (1), at the bottom left of the P2K window, under the section of "Select Byte Type".

It appears I want 6A and Bit Zero(0) turn turn on the Pics/uploads, etc....

I am getting confused here, please clarify if you can..

Thanks,N.
 
Post a Comment

<< Home

This page is powered by Blogger. Isn't yours?