FILES SET FOR FLASHING:
MCU Flash file: C:\Program Files\Nokia\Phoenix\Products\Products\RM-178\rm178b503.710.mcusw.bin
PPM Flash file: C:\Program Files\Nokia\Phoenix\Products\Products\RM-178\rm178b503.71.ppm_e
CNT Flash file: C:\Program Files\Nokia\Phoenix\Products\Products\RM-178\rm178b503.71.image_e
APE Variant file: NONE
Languages in ppm: English,German,Lithuanian,Latvian,Russian,Estonian,Bulgarian,Romanian,Ukrainian
Manual mode selected, version can't be checked!
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 21200003D32500545C09B4AAA251910B918D4EED
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.15.00 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.15.00 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 5 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 2 minutes 5 seconds...
Writing...
Stage 1
Sending CMT HASH for NOLO
Sending CMT HASH for KEYS
Sending CMT PUB KEYS...
Sending CMT HASH for DSP0
Sending CMT HASH for PMM_CONF
Sending CMT HASH for SBIF_CONF
Sending CMT HASH for PASUBTOC
Sending CMT HASH for PRIMAPP
Sending CMT HASH for UPDAPP
Sending CMT HASH for MCUSW
Operation took 1 minutes 47 seconds...
Reseting phone...
PPM: C:\Program Files\Nokia\Phoenix\Products\Products\RM-178\rm178b503.71.ppm_e
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 21200003D32500545C09B4AAA251910B918D4EED
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.15.00 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.15.00 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 5 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 1 seconds...
Writing...
Stage 1
Operation took 0 minutes 25 seconds...
Reseting phone...
CNT: C:\Program Files\Nokia\Phoenix\Products\Products\RM-178\rm178b503.71.image_e
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 21200003D32500545C09B4AAA251910B918D4EED
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.15.00 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.15.00 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 6 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 1 minutes 42 seconds...
Writing...
Stage 1
Operation took 0 minutes 36 seconds...
Reseting phone...
Done!
Total time: 6 Minutes, 54 Seconds
DCT4/BB5 counter: 89
After flash processing...
Waiting for phone to boot...
Reading...
Phone type: RM-178, Software version: 03.71
IMEI: 12345610654321?
APE Ver: (null)
Variant Ver: (null)
Product Code: 0531575
Setting FULL FACTORY......Setting test mode...
Setting FULL FACTORY...
Operation took 0 minutes 15 seconds...
Done!
Done!
Done!
-------------------------------------------------------------------------
Всё прошилось на ура, но только прошивой от 6125 ....
Шил 6270(разные версии),6233(разные версии),6131(разные версии) - работал только flashmode, но если ставлю прошивку от 6125, то все
режимы (local, test, normal, pm read/write) работают.
Заливал сертификаты с 308м, изменения только в ЛОКАХ.
-------Кто шарит... Взгляните на сравнение быкапов 308го ------------------------------------------------------------------------
Сравнение файлов 357576006174096_CRT_backup_1827158.pm и RM-178_12345610654321_308_308.PM
000000A9: 39 30
000000AA: 39 30
000000AB: 37 30
000000AC: 32 30
000000AD: 31 30
000000AE: 43 30
000000AF: 43 30
000000B0: 46 30
000000B1: 34 30
000000B2: 41 30
000000B3: 37 30
000000B4: 34 30
000000B5: 31 30
000000B6: 37 30
000000B7: 46 30
000000B8: 32 30
000000B9: 35 30
000000BA: 35 30
000000BB: 36 30
000000BC: 38 30
000000BD: 37 30
000000BE: 33 30
000000BF: 33 30
000000C0: 42 30
000000C1: 35 30
000000C2: 34 30
000000C3: 37 30
000000C4: 43 30
000000C5: 38 30
000000C6: 33 30
000000C7: 32 30
000000C8: 39 30
--------Интересный хекс, не правда ли? а отличие 1-не лочен, 2-лочен.
6270 с флехой от 6125 прошилась только как 6125(local, test
k).
6270 с флехой от 6125 не прошилась как 6270(local, test:error!), те не проходит "AfterFlashProcessing".
Вот инфа о нокии 6270 с прошивой от 6125.
-------------------
Reading...
MCU SW version: V 03.71
31-05-06
RM-178
(c) Nokia.
HW version: 0204
PCI version:
RFIC version: 17191719
DSP version: pb05w46v27
PPM version: V 03.71
31-05-06
RM-178
(c) Nokia.
E
Retu version: 32
Tahvo version: 52
Content Pack version: Content: e
V 03.71
31-05-06
RM-178
(c) Nokia.
Production serial number: CFH651907
Product code: 0531575
Module code:
Basic production code: 0529960
Flash code:
Order number:
Product specific data:
Long production SN:
ATO:
Default SN type:
IMEI plain: 12345610654321?
IMEI spare to net: 1A 32 54 16 60 45 23 01
IMEI SV to net: 13 32 54 16 60 45 23 01 F4
LOCK STATUS:
CONFIG KEY: 2440700000000000
Provider: AT&T;U.S.A. (3650)
Key Code count: 0, FBUS Code count: 0
Block 1:
Lock 1: OPEN Lock 2: OPEN Lock 3: OPEN Lock 4: OPEN Lock 5: OPEN
Block 2:
Lock 1: OPEN Lock 2: OPEN Lock 3: OPEN Lock 4: OPEN Lock 5: OPEN
Block 3:
Lock 1: OPEN Lock 2: OPEN Lock 3: OPEN Lock 4: OPEN Lock 5: OPEN
Block 4:
Lock 1: OPEN Lock 2: OPEN Lock 3: OPEN Lock 4: OPEN Lock 5: OPEN
Block 5:
Lock 1: OPEN Lock 2: OPEN Lock 3: OPEN Lock 4: OPEN Lock 5: OPEN
Block 6:
Lock 1: OPEN Lock 2: OPEN Lock 3: OPEN Lock 4: OPEN Lock 5: OPEN
Block 7:
Lock 1: OPEN Lock 2: OPEN Lock 3: OPEN Lock 4: OPEN Lock 5: OPEN
--------------------------
Короче говоря, я подустал пока эксперементировать, но сделал выводы:
CPU и во Flash есть взаимные ключи, причем я уверен, что все локи в
308ом блоке! + криптованные ключи к OTP CPU и флеш. --------
(подскажите отп во влешке используется??)
Я думаю, что скоро можно будет заходить в LOCAL при помощи тестпоинта
и работать с EEPROM'ом (PM) как угодно...
Да ещё подскажите ... Датащиты где достать на RAP3G.
И ещё, те кто знает ... В CPU rap3g bootROM или bootRAM.
Если bootROM, то для взлома только JTAG или рекальк PM.
Если bootRAM, то патчить его надо вместе с mcu(прошивой).
------------------------------------------------------------------------
ДАВАЙТЕ ДУМАТЬ ВМЕСТЕ!!! ВСЁ ГЕНИАЛЬНОЕ ПРОСТО! Чем сложнее и
навороченее защита, тем более она уязвима.........................
P.S. Извините за ошибки и неправильный оборот речи(местами)