22 Mar
2014
22 Mar
'14
4:39 a.m.
Greetings,
I have a Motorola C139 handset with SW Ver 1.9.24 and a CP2102 USB/UART
adapter, which I hope(d) to use with osmocom-bb.
In Ubuntu 13.10 (running on [non-virtualized] hardware with an Intel i5-750
CPU), I compiled the toolchain, prerequisites, and osmocom-bb, but when I
run the following command (and then briefly press the phone's power button)
:
./osmocon -p /dev/ttyUSB0 -m c140
../../target/firmware/board/compal_e86/loader.compalram.bin
I get the following output:
got 7 bytes from modem, data looks like: 66 74 6d 74 6f 6f 6c ftmtool
Received FTMTOOL from phone, ramloader has aborted
got 1 bytes from modem, data looks like: 65 e
got 1 bytes from modem, data looks like: 72 r
got 1 bytes from modem, data looks like: 72 r
got 1 bytes from modem, data looks like: 6f o
got 1 bytes from modem, data looks like: 72 r
If I briefly press the power button repeatedly, I receive similar output.
I would greatly appreciate any suggestions as to how I might be able to
coax this into working.
Thanks,
Rusty D
22 Mar
22 Mar
10:55 a.m.
Hi,
./osmocon -p /dev/ttyUSB0 -m c140
../../target/firmware/board/compal_e86/loader.compalram.bin
I get the following output:
got 7 bytes from modem, data looks like: 66 74 6d 74 6f 6f 6c ftmtool
Received FTMTOOL from phone, ramloader has aborted
I would greatly appreciate any suggestions as to how I
might be able to coax
this into working.
Also, try the -c option (see bottom of
http://bb.osmocom.org/trac/wiki/MotorolaC140 )
If that doesn't work you can try some of the other -m options
If that still doesn't work, just get another phone and/or another cable.
Seriously, the compal bootloader is a piece of shit, we can't do
anything about it, and trying to remote debug serial loading issue is
a waste of our time.
If you want to debug it yourself, read the source of the osmocon tool
to see what's _supposed_ to happen, then look at the raw bytes
exchanged to see what happenned. Also look at the raw signal lines
with scope and a logic analyzer to identify timing and signal
integrity problems. If that doesn't yield anything you might need to
dump the flash (how ? good question ... no idea what option there is
without being able to load code. jtag, or chip unsoldering ?), and
reverse engineer the boot loader to see what changed.
Cheers,
Sylain
6 Apr
6 Apr
10:09 p.m.
On Fri, Mar 21, 2014 at 11:39 PM, Rusty Dekema <rdekema(a)gmail.com> wrote:
Greetings,
I have a Motorola C139 handset with SW Ver 1.9.24 and a CP2102
USB/UART adapter, which I hope(d) to use with osmocom-bb.
[...]
Many thanks for all your help and suggestions. I have tried everything
that was suggested (and more) and have still not been able to load
osmocom-bb onto that particular C139. That said, it has been a good
learning experience.
Although I would still like to eventually get a C139 working (mainly
for its 850 MHz support), I obtained a C118 yesterday and it works
with osmocom-bb like a charm, right out of the box. (It also has at
least some support for the PCS1900 band, which was a pleasant
surprise.) I really appreciate all the work that has gone into this
software, and I'm amazed at how much it can do.
Now, back to the C139. If anyone has any further suggestions, please
let me know. Other than that, I'm mainly sending these responses out
of courtesy and for the benefit of people who may stumble across the
list archive while searching for information on the subject.
To the OP: in case you haven't already figured it
out, you need to use
-m c140xor with C139 and C140 phones. I don't know what phones would
-m c140 (w/o xor) be correct for, if any. Sylvain's direction to use
the -c option as well (and then use *.highram.bin instead of
*.compalram.bin)
is also correct, because the images are bigger than the ~15k max one
can download w/o -c on this phone.
Thanks for the info; I tried both of these but got the same result.
The phone never sends a PROMPT1 for reasons discovered later and
described above.
Also you said your C139 came with fw version
"V1.9.24" - are you sure
it isn't V1.0.24 instead? The imprint on those stickers is a pain to
read, too small...
Yes, it's definitely 1.9.24 both on the sticker and the #02# screen.
Additionally, in the #02# screen, there is an item shown that says
either "UART: 1" or "UART Flag: 1". Various forum posts by members of
the unlocking community suggest that this may be an indication that
bootloader/flashing access via the serial port is locked down on a
given handset.
I had a similar problem with a tracfone branded c139
(ftmtool error). On
IRC, Hoernchen mentioned an older post where the author "fixed" the
bootloader. He also mentioned a pastebin that referenced a tool called
mot931c. I managed to find it and could successfully reflah my tracfone's
bootloader, which now loads osmocom-bb without issue. Here's the
reuploaded software package:
https://drive.google.com/file/d/0ByHQWL5Q6bSwdkJReUlJWUQ1Z3M/edit?usp=shari…
When I run the mot931c program, follow the directions, and click
Unlock, I get the output: "Error 2" followed by "Phone not found". Of
note, if I unplug the phone from the computer and do the same, I get
only the "Phone not found" message. Then again, the title of the
mot931c application is "Tracfone mobile unlock 1.0 by Lawer," and mine
is not a Tracfone.
It should be noted that the new bootloader is very
limited (no charging, no
loading of the regular phone os). I found another tool, called "C139 FULL
SOLUTION UNLOCK AND FLASH", that successfully could flash a proper
firmware (European_Software in the archive it is version 1.0.03.E):
https://drive.google.com/file/d/0ByHQWL5Q6bSwTWdhRFAyU05uLUk/edit?usp=shari…
Nonethless this particular (trac)phone is still limited to the US bands.
The DLTool/"DM Tool" software in this package does not seem to be able
to "see" or communicate with the phone. After following the directions
and clicking Start, nothing happens for a few minutes after which a
timeout error is shown. Perhaps this is not surprising, since the
mot931c tool was not able to "unlock" whatever it was supposed to
unlock on this phone.
Has anyone figured out just what this (presumably)
closed source
mot931c.exe binary sends to the phone?
I have not, but I wouldn't mind trying. I do not have any test
equipment for serial communication, but perhaps I could find some
software (or use a VM environment) that would let me observe the
communication between mot931c.exe and the phone. Then again, since
mot931c.exe does not seem to work with the C139 I have, I'm not sure
how much that would help.
Sincerely,
Rusty D
11:54 p.m.
Rusty,
I'm unsure, but it's possible mot931c might be sensitive to timing issues.
At first I tried with portmon running, and it would fail. I could finally
get it working after a couple tries. Note this was using XP on a real host
(not a VM). But as the tool was made specifically for tracfone, thus it's
likely the payload would not work on other carriers.
On Sun, Apr 6, 2014 at 10:09 PM, Rusty Dekema <rdekema(a)gmail.com> wrote:
On Fri, Mar 21, 2014 at 11:39 PM, Rusty Dekema
<rdekema(a)gmail.com> wrote:
Greetings,
I have a Motorola C139 handset with SW Ver 1.9.24 and a CP2102
USB/UART adapter, which I hope(d) to use with osmocom-bb.
[...]
Many thanks for all your help and suggestions. I have tried everything
that was suggested (and more) and have still not been able to load
osmocom-bb onto that particular C139. That said, it has been a good
learning experience.
Although I would still like to eventually get a C139 working (mainly
for its 850 MHz support), I obtained a C118 yesterday and it works
with osmocom-bb like a charm, right out of the box. (It also has at
least some support for the PCS1900 band, which was a pleasant
surprise.) I really appreciate all the work that has gone into this
software, and I'm amazed at how much it can do.
Now, back to the C139. If anyone has any further suggestions, please
let me know. Other than that, I'm mainly sending these responses out
of courtesy and for the benefit of people who may stumble across the
list archive while searching for information on the subject.
To the OP: in case you haven't already
figured it out, you need to use
-m c140xor with C139 and C140 phones. I don't know what phones would
-m c140 (w/o xor) be correct for, if any. Sylvain's direction to use
the -c option as well (and then use *.highram.bin instead of
*.compalram.bin)
is also correct, because the images are bigger than the ~15k max one
can download w/o -c on this phone.
Thanks for the info; I tried both of these but got the same result.
The phone never sends a PROMPT1 for reasons discovered later and
described above.
Also you said your C139 came with fw version
"V1.9.24" - are you sure
it isn't V1.0.24 instead? The imprint on those stickers is a pain to
read, too small...
Yes, it's definitely 1.9.24 both on the sticker and the #02# screen.
Additionally, in the #02# screen, there is an item shown that says
either "UART: 1" or "UART Flag: 1". Various forum posts by members
of
the unlocking community suggest that this may be an indication that
bootloader/flashing access via the serial port is locked down on a
given handset.
I had a similar problem with a tracfone branded
c139 (ftmtool error). On
IRC, Hoernchen mentioned an older post where the author "fixed" the
bootloader. He also mentioned a pastebin that referenced a tool called
mot931c. I managed to find it and could successfully reflah my tracfone's
bootloader, which now loads osmocom-bb without issue. Here's the
reuploaded software package:
https://drive.google.com/file/d/0ByHQWL5Q6bSwdkJReUlJWUQ1Z3M/edit?usp=shari…
When I run the mot931c program, follow the directions, and click
Unlock, I get the output: "Error 2" followed by "Phone not found".
Of
note, if I unplug the phone from the computer and do the same, I get
only the "Phone not found" message. Then again, the title of the
mot931c application is "Tracfone mobile unlock 1.0 by Lawer," and mine
is not a Tracfone.
It should be noted that the new bootloader is
very limited (no charging,
no
loading of the regular phone os). I found another
tool, called "C139 FULL
SOLUTION UNLOCK AND FLASH", that successfully could flash a proper
firmware (European_Software in the archive it is version 1.0.03.E):
https://drive.google.com/file/d/0ByHQWL5Q6bSwTWdhRFAyU05uLUk/edit?usp=shari…
Nonethless this particular (trac)phone is still
limited to the US bands.
The DLTool/"DM Tool" software in this package does not seem to be able
to "see" or communicate with the phone. After following the directions
and clicking Start, nothing happens for a few minutes after which a
timeout error is shown. Perhaps this is not surprising, since the
mot931c tool was not able to "unlock" whatever it was supposed to
unlock on this phone.
Has anyone figured out just what this (presumably)
closed source
mot931c.exe binary sends to the phone?
I have not, but I wouldn't mind trying. I do not have any test
equipment for serial communication, but perhaps I could find some
software (or use a VM environment) that would let me observe the
communication between mot931c.exe and the phone. Then again, since
mot931c.exe does not seem to work with the C139 I have, I'm not sure
how much that would help.
Sincerely,
Rusty D
7 Apr
7 Apr
12:51 a.m.
On Sun, Apr 6, 2014 at 5:54 PM, Christophe Devine
<devinechristophe(a)gmail.com> wrote:
Rusty,
I'm unsure, but it's possible mot931c might be sensitive to timing issues.
At first I tried with portmon running, and it would fail. I could finally
get it working after a couple tries. Note this was using XP on a real host
(not a VM). But as the tool was made specifically for tracfone, thus it's
likely the payload would not work on other carriers.
That makes sense; I was running it on a win7 non-virtual machine. I'll
snag a cheap tracfone one of these days and see if I can do anything
with it. I'll try to find the most dinged-up one I can; hopefully it
will be old and not completely locked down :).
-Rusty
3683
days inactive
3698
days old
baseband-devel@lists.osmocom.org
4 comments
3 participants
participants (3)
-
Christophe Devine -
Rusty Dekema -
Sylvain Munaut