Motorola C139 V1.9.24 Won't Load from osmocom-bb
Greetings, I have a Motorola C139 handset with SW Ver 1.9.24 and a CP2102 USB/UART adapter, which I hope(d) to use with osmocom-bb. In Ubuntu 13.10 (running on [non-virtualized] hardware with an Intel i5-750 CPU), I compiled the toolchain, prerequisites, and osmocom-bb, but when I run the following command (and then briefly press the phone's power button) : ./osmocon -p /dev/ttyUSB0 -m c140 ../../target/firmware/board/compal_e86/loader.compalram.bin I get the following output: got 7 bytes from modem, data looks like: 66 74 6d 74 6f 6f 6c ftmtool Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r If I briefly press the power button repeatedly, I receive similar output. I would greatly appreciate any suggestions as to how I might be able to coax this into working. Thanks, Rusty D
Hi,
./osmocon -p /dev/ttyUSB0 -m c140 ../../target/firmware/board/compal_e86/loader.compalram.bin
I get the following output:
got 7 bytes from modem, data looks like: 66 74 6d 74 6f 6f 6c ftmtool Received FTMTOOL from phone, ramloader has aborted
I would greatly appreciate any suggestions as to how I might be able to coax this into working.
Also, try the -c option (see bottom of http://bb.osmocom.org/trac/wiki/MotorolaC140 ) If that doesn't work you can try some of the other -m options If that still doesn't work, just get another phone and/or another cable. Seriously, the compal bootloader is a piece of shit, we can't do anything about it, and trying to remote debug serial loading issue is a waste of our time. If you want to debug it yourself, read the source of the osmocon tool to see what's _supposed_ to happen, then look at the raw bytes exchanged to see what happenned. Also look at the raw signal lines with scope and a logic analyzer to identify timing and signal integrity problems. If that doesn't yield anything you might need to dump the flash (how ? good question ... no idea what option there is without being able to load code. jtag, or chip unsoldering ?), and reverse engineer the boot loader to see what changed. Cheers, Sylain
On Fri, Mar 21, 2014 at 11:39 PM, Rusty Dekema <rdekema@gmail.com> wrote:
Greetings,
I have a Motorola C139 handset with SW Ver 1.9.24 and a CP2102 USB/UART adapter, which I hope(d) to use with osmocom-bb. [...]
Many thanks for all your help and suggestions. I have tried everything that was suggested (and more) and have still not been able to load osmocom-bb onto that particular C139. That said, it has been a good learning experience. Although I would still like to eventually get a C139 working (mainly for its 850 MHz support), I obtained a C118 yesterday and it works with osmocom-bb like a charm, right out of the box. (It also has at least some support for the PCS1900 band, which was a pleasant surprise.) I really appreciate all the work that has gone into this software, and I'm amazed at how much it can do. Now, back to the C139. If anyone has any further suggestions, please let me know. Other than that, I'm mainly sending these responses out of courtesy and for the benefit of people who may stumble across the list archive while searching for information on the subject.
To the OP: in case you haven't already figured it out, you need to use -m c140xor with C139 and C140 phones. I don't know what phones would -m c140 (w/o xor) be correct for, if any. Sylvain's direction to use the -c option as well (and then use *.highram.bin instead of *.compalram.bin) is also correct, because the images are bigger than the ~15k max one can download w/o -c on this phone.
Thanks for the info; I tried both of these but got the same result. The phone never sends a PROMPT1 for reasons discovered later and described above.
Also you said your C139 came with fw version "V1.9.24" - are you sure it isn't V1.0.24 instead? The imprint on those stickers is a pain to read, too small...
Yes, it's definitely 1.9.24 both on the sticker and the #02# screen. Additionally, in the #02# screen, there is an item shown that says either "UART: 1" or "UART Flag: 1". Various forum posts by members of the unlocking community suggest that this may be an indication that bootloader/flashing access via the serial port is locked down on a given handset.
I had a similar problem with a tracfone branded c139 (ftmtool error). On IRC, Hoernchen mentioned an older post where the author "fixed" the bootloader. He also mentioned a pastebin that referenced a tool called mot931c. I managed to find it and could successfully reflah my tracfone's bootloader, which now loads osmocom-bb without issue. Here's the reuploaded software package:
https://drive.google.com/file/d/0ByHQWL5Q6bSwdkJReUlJWUQ1Z3M/edit?usp=sharin...
When I run the mot931c program, follow the directions, and click Unlock, I get the output: "Error 2" followed by "Phone not found". Of note, if I unplug the phone from the computer and do the same, I get only the "Phone not found" message. Then again, the title of the mot931c application is "Tracfone mobile unlock 1.0 by Lawer," and mine is not a Tracfone.
It should be noted that the new bootloader is very limited (no charging, no loading of the regular phone os). I found another tool, called "C139 FULL SOLUTION UNLOCK AND FLASH", that successfully could flash a proper firmware (European_Software in the archive it is version 1.0.03.E): https://drive.google.com/file/d/0ByHQWL5Q6bSwTWdhRFAyU05uLUk/edit?usp=sharin... Nonethless this particular (trac)phone is still limited to the US bands.
The DLTool/"DM Tool" software in this package does not seem to be able to "see" or communicate with the phone. After following the directions and clicking Start, nothing happens for a few minutes after which a timeout error is shown. Perhaps this is not surprising, since the mot931c tool was not able to "unlock" whatever it was supposed to unlock on this phone.
Has anyone figured out just what this (presumably) closed source mot931c.exe binary sends to the phone?
I have not, but I wouldn't mind trying. I do not have any test equipment for serial communication, but perhaps I could find some software (or use a VM environment) that would let me observe the communication between mot931c.exe and the phone. Then again, since mot931c.exe does not seem to work with the C139 I have, I'm not sure how much that would help. Sincerely, Rusty D
Rusty, I'm unsure, but it's possible mot931c might be sensitive to timing issues. At first I tried with portmon running, and it would fail. I could finally get it working after a couple tries. Note this was using XP on a real host (not a VM). But as the tool was made specifically for tracfone, thus it's likely the payload would not work on other carriers. On Sun, Apr 6, 2014 at 10:09 PM, Rusty Dekema <rdekema@gmail.com> wrote:
On Fri, Mar 21, 2014 at 11:39 PM, Rusty Dekema <rdekema@gmail.com> wrote:
Greetings,
I have a Motorola C139 handset with SW Ver 1.9.24 and a CP2102 USB/UART adapter, which I hope(d) to use with osmocom-bb. [...]
Many thanks for all your help and suggestions. I have tried everything that was suggested (and more) and have still not been able to load osmocom-bb onto that particular C139. That said, it has been a good learning experience.
Although I would still like to eventually get a C139 working (mainly for its 850 MHz support), I obtained a C118 yesterday and it works with osmocom-bb like a charm, right out of the box. (It also has at least some support for the PCS1900 band, which was a pleasant surprise.) I really appreciate all the work that has gone into this software, and I'm amazed at how much it can do.
Now, back to the C139. If anyone has any further suggestions, please let me know. Other than that, I'm mainly sending these responses out of courtesy and for the benefit of people who may stumble across the list archive while searching for information on the subject.
To the OP: in case you haven't already figured it out, you need to use -m c140xor with C139 and C140 phones. I don't know what phones would -m c140 (w/o xor) be correct for, if any. Sylvain's direction to use the -c option as well (and then use *.highram.bin instead of *.compalram.bin) is also correct, because the images are bigger than the ~15k max one can download w/o -c on this phone.
Thanks for the info; I tried both of these but got the same result. The phone never sends a PROMPT1 for reasons discovered later and described above.
Also you said your C139 came with fw version "V1.9.24" - are you sure it isn't V1.0.24 instead? The imprint on those stickers is a pain to read, too small...
Yes, it's definitely 1.9.24 both on the sticker and the #02# screen. Additionally, in the #02# screen, there is an item shown that says either "UART: 1" or "UART Flag: 1". Various forum posts by members of the unlocking community suggest that this may be an indication that bootloader/flashing access via the serial port is locked down on a given handset.
I had a similar problem with a tracfone branded c139 (ftmtool error). On IRC, Hoernchen mentioned an older post where the author "fixed" the bootloader. He also mentioned a pastebin that referenced a tool called mot931c. I managed to find it and could successfully reflah my tracfone's bootloader, which now loads osmocom-bb without issue. Here's the reuploaded software package:
https://drive.google.com/file/d/0ByHQWL5Q6bSwdkJReUlJWUQ1Z3M/edit?usp=sharin...
When I run the mot931c program, follow the directions, and click Unlock, I get the output: "Error 2" followed by "Phone not found". Of note, if I unplug the phone from the computer and do the same, I get only the "Phone not found" message. Then again, the title of the mot931c application is "Tracfone mobile unlock 1.0 by Lawer," and mine is not a Tracfone.
It should be noted that the new bootloader is very limited (no charging, no loading of the regular phone os). I found another tool, called "C139 FULL SOLUTION UNLOCK AND FLASH", that successfully could flash a proper firmware (European_Software in the archive it is version 1.0.03.E):
https://drive.google.com/file/d/0ByHQWL5Q6bSwTWdhRFAyU05uLUk/edit?usp=sharin...
Nonethless this particular (trac)phone is still limited to the US bands.
The DLTool/"DM Tool" software in this package does not seem to be able to "see" or communicate with the phone. After following the directions and clicking Start, nothing happens for a few minutes after which a timeout error is shown. Perhaps this is not surprising, since the mot931c tool was not able to "unlock" whatever it was supposed to unlock on this phone.
Has anyone figured out just what this (presumably) closed source mot931c.exe binary sends to the phone?
I have not, but I wouldn't mind trying. I do not have any test equipment for serial communication, but perhaps I could find some software (or use a VM environment) that would let me observe the communication between mot931c.exe and the phone. Then again, since mot931c.exe does not seem to work with the C139 I have, I'm not sure how much that would help.
Sincerely, Rusty D
On Sun, Apr 6, 2014 at 5:54 PM, Christophe Devine <devinechristophe@gmail.com> wrote:
Rusty,
I'm unsure, but it's possible mot931c might be sensitive to timing issues. At first I tried with portmon running, and it would fail. I could finally get it working after a couple tries. Note this was using XP on a real host (not a VM). But as the tool was made specifically for tracfone, thus it's likely the payload would not work on other carriers.
That makes sense; I was running it on a win7 non-virtual machine. I'll snag a cheap tracfone one of these days and see if I can do anything with it. I'll try to find the most dinged-up one I can; hopefully it will be old and not completely locked down :). -Rusty
participants (3)
-
Christophe Devine -
Rusty Dekema -
Sylvain Munaut