K750 - Cid49brown To Cid49red, Needs a service cable Options

[Martin_sw]

By using this software or any of it's supplied components you agree to this disclaimer.
-----------------
Disclaimer,
Anything YOU do to your or someone elses phone is entirely YOUR responsibility NOT mine(Martin_sw), I shall
not under any circumstances be held responsible for your actions.
-----------------

Hello, this program is designed to flash your D750/K750/W800(maby W700 to ?) CID49Brown EROM
phone to a red EROM so you may enjoy all the pleasures of having a red EROM, like flashing your K750 to a W800.

Now, to do this you need a service cable, not the one that comes with the phone(DCU60), you need a cable like
Crusier, Fighter/TMS or the like.

Note: The program defaults to COM7, to change comport use the commandline -p /COM6 (6 is the desired port)

The process of flashing the EROM is simple, just start the program and connect your phone, then when promted to
enter a command, enter: c [PUSH ENTER]. Now just wait until the program tells you it's safe to disconnect
your phone. And voila you are now the proud owner of a red EROM phone

Credits:
Hendrix - This software is based on his PhoneXC.
jagheterfredrik - For all his help and support, a good friend

This post has been edited by Martin_sw: 2007-02-28 19:12

Attached File(s)

 k750_cid49brown2red.rar ( 110.22K ) Number of downloads: 1025
 k750_cid49brown2red_1.1.rar ( 100.79K ) Number of downloads: 916

 

[jagheterfredrik]

Good work man, but where are my creds ?

[kondronaute]

great you are champion men , thanks to you martin and to hendrix

[kondronaute]

@ jagheterfredrik : a GUI interface

[jagheterfredrik]

Hehe

[Martodox]

Hi guys. I hope that you Martin_sw don't mind, that I translated this into polish? My translated version

[Martin_sw]

@jagheterfredrik

What do you want creds for ? , nah just pulling your leg , it's fixed now...

@Martodox

No problem at all, infact it's good that you did, makes it avaible to more pepole

Now have any brown users had any sucess flashing thier EROMs yet?

This post has been edited by Martin_sw: 2007-02-27 14:22

[wiraone]

I wish I could test it .. but no, I don't have any service cable and I couldn't get it locally either.

[Karun]

finally smthing fr brown phone owners out there.........

awesum work........

[sethdev]

I have a TMS cable and does not work, my TMS Cable is on Com3 and try to run app from command line with -p com3 and does not work

this hang here:

***** Please connect your phone, you have forever.
Phone detected.
*****
Phone information:
DBID : db2010 Marita compact
proto : 3.1
fill : ffffffff
Phone certificate: c@A1_DB2010_49_BROWN
Cannot open /COM7 at all
*****
Commands: c = convert cid49brown to cid49red

OK, now we start.

c
sending db2010_cid49brown_flash_r2ab.bin
QH00 Header
Wait for EsB

This post has been edited by sethdev: 2007-02-28 15:16

[Martin_sw]

I have a TMS cable and does not work, my TMS Cable is on Com3 and try to run app from command line with -p com3 and does not work

this hang here:

***** Please connect your phone, you have forever.
Phone detected.
*****
Phone information:
DBID : db2010 Marita compact
proto : 3.1
fill : ffffffff
Phone certificate: c@A1_DB2010_49_BROWN
Cannot open /COM7 at all
*****
Commands: c = convert cid49brown to cid49red

OK, now we start.

c
sending db2010_cid49brown_flash_r2ab.bin
QH00 Header
Wait for EsB

Ok, good work you just found a bug , it's fixed now, i have uploaded a new version to my first post. Thanks for trying and good luck whit the new version , let me know how it goes ok.

[sethdev]

Ok, good work you just found a bug , it's fixed now, i have uploaded a new version to my first post. Thanks for trying and good luck whit the new version , let me know how it goes ok.

you're welcome, I'm proud to be a BetaTester.
I have changed my cid49brown to cid49red with the first version, just changed my TMS COM3 to COM7, Good job Martin_sw now I`m ready to convert my K750 to W800.
thx

[Martin_sw]

you're welcome, I'm proud to be a BetaTester.
I have changed my cid49brown to cid49red with the first version, just changed my TMS COM3 to COM7, Good job Martin_sw now I`m ready to convert my K750 to W800.
thx

Great , nice to see someone have some use for it . Does everything work as before? because i tried flashing my originally cid49red phone to brown, but it refuses to boot my main so there must be more than the EROM thats diffrent on brown phones . But i suspect it's a one way problem whit red2brown only, so you should have a working phone .

This post has been edited by Martin_sw: 2007-03-01 11:09

[Sam.12]

Cool manual and soft
Thanx Martin you are boss

Sorry my bad english I am slovak

[mehacz]

Please help me because when I clicked on "k750-cid49brown2red.exe" file blank window blinks and nothing gonna happened;/ what's wrong?? SETHDEV can you give print screens of your flashing??

[manninca]

Hi guys, so this will really work to convert my 2 month old k750 cid49 brown to cid49 red so I can then debrand and get rid of all the vodafone rubbish?

Can somebody write a really basic description of the difference between brown and red eroms is and why do they keep changing them? just for interest?

Cheers

Chris

[Geolog]

well live I method hope in rossii. works.
Differences between brown red telephone in that that in brown it is impossible work with main and in particular flash

much apologize for its english

[eyeyousee]

Hi guys, so this will really work to convert my 2 month old k750 cid49 brown to cid49 red so I can then debrand and get rid of all the vodafone rubbish?

Can somebody write a really basic description of the difference between brown and red eroms is and why do they keep changing them? just for interest?

Cheers

Chris

SCRIPT BY TZESTOS:


CID = This "number" defines the version of SE's protection present in the phone.New CIDs are deployed from time to time, for the sole reason of preventing them from beeing unlocked/flashed/tampered with by non-SE service tools. Current CIDs in use by SE are 29/36/37/49/51. SE-based LG/Sharp phones use the same system (but different versions). The OTP (One Time Programmable memory) and EROM of a phone might be protected by different CIDs, usually the case in newer K600s/K608s.

CDA = This "number" defines which variant of a specific firmware a phone is supposed to have. It lets, among others, SEUS (Sony Ericsson Update Service) know which language-pack/branding/bandlocks a phone is to be flashed with. A generic (unbranded) K750 for use in Scandinavia will be CDA102337/12, whilst a Telenor-branded K750 will be CDA102338/62. Both will be flashed with the same languages/dictionaries, but the latter will be flashed with Telenor-branded firmware.

BLUE/BROWN/RED:This "color" defines what kind of phone we are dealing with. BLUE phones have been assembled at the factory, but never been programmed with software/GDFS/IMEI (remember kids: the IMEI is stored in the OTP (One Time Programmable memory). BROWN phones are "developer phones", for testing. Less restrictions are present, as these are used for "debugging/beta" purposes. As of CID36, a phone has to be converted to BROWN to unlock it.RED phones are your typical retail ones.

GDFS:This is the phones "stash", where all settings and calibration data is stored (this also goes for the firmwares IMEI-resource as well as the SIMlocks). Similar to other brands use of NVRAM (Non-Viotile Random Access Memory).

IMEI = International Mobile Equipment Identity. A 15-digit number which includes information on the origin, model, and serial number of the device. The model and origin comprise the initial 8-digit portion of the IMEI, known as the "Type Allocation Code/TAC". The remainder of the IMEI is manufacturer-defined, with a "Luhn check digit" at the end (which is never transmitted). The "Luhn check digit" is calculated from the rest of the IMEI.
It should be noted that in SE-based phones, the IMEI is stored in two places, the OTP (One Time Programmable memory) and GDFS. The GDFS IMEI is normally read from the OTP, but this can be circumvented by SETool function to "change" the IMEI. This patches the firmware into allowing different OTP/GDFS IMEIs. It is the GDFS IMEI that is reported to the network, so changing this will "de-bar" blocked phones. SEUS is not fooled by this, on the other hand, and it should also be noted that doing this is illegal in most countries.

EMMA = Service software/solution by SE themselves. Protected by the EMMA smartcard to prevent non-licensed usage. Current version is EMMA3, though EMMA2 is still alive (but kinda useless on newer phones). The EMMA smartcard contains an algorithm that allows EMMA to communicate directly to/with the phones CID, so performing operations the way they were intended. The smartcard and its algorithm has not been cracked. Current EMMA access levels exists: Service Update - Can't unlock phones. Service Update Pro - Can't unlock phones. Network Operator - Can't unlock phones (but sure as hell can lock them ). Service Center Std - Can't unlock phones. Service Center Rc - Can unlock phones, as they have a special version of the smartcard with a CSCA key. Research & Development - Can unlock phones, as they have a special version of the smartcard with a CSCA key.

DB2000, DB2010, DB2020 = SEMC (Sony Ericsson Mobile Communications) hardware platforms. It's something similar to chipset in PC. DB2000 (another name is Marita) is a GSM+3G (UMTS) capable platform, SE K600/K608/V600/Z800/W900, Sharp 802sh, 902sh, 903sh and LG 3G phones are based on it. DB2010/2012 (Marita compact) is GSM-only, non-3G, platform. Most not very old and modern SE phones like K300,K500,K700,K750,S700,W300,W550,W800,Z520,Z530 are based on this chipset. DB2020 is the newest product of SEMC. K800, K790, K610, Z710 etc, Sharp 904sh feature this most secure (from SE's point of view) platform.

EROM = Extended ROM. This is the base part of the software which isn't flashed in normal update operations. It controls the flashing interface, the boot loader, etc.

FOTA = Flash Over The Air. The Sony Ericsson Remote Update Service is a convenient way to easily and remotely update your mobile phone to the latest available software version. This is done over the air; no connection to a PC is needed. The cost for using Sony Ericsson Remote Update Service is your operator's fee for transferring the data to your phone. This varies widely between different operators; if you are uncertain you should contact your operator. User content in the phone, such as images, music, ringtones and videos, is not affected by the update.

Customization = Changing or replacing original content of the phone, like ringtones, wallpapers, icons, themes, that come with branded or unbranded phones. It's nothing more than first default configuring of the phone after flashing FS file. Usually the process is:
1. Writing customize.xml and server & java certificates in /tpa/preset/custom in sonics folder to /tpa/presest/custom folder in the phone's internal file system
2. When the phone starts after flashing, it parses that xml file, puts settings written in that xml into the phone's GDFS and works out certificates (some go to Trusted certificates, some got Java certificate etc)
If you open customize.xml you can change almost any initial settings like time zone, date, internet profiles etc.

Branded Phones = Some network providers place their own ringtones, themes, icons, links etc within phone's software. (eg. vodafone/telenor, orange, t-mobile, rogers, cingular etc.) Debranding means removing all this content and restoring phone to it's original factory SONYERICSSON condition. This will not damage phone in any way! You will loose Operator Icons, and links, WAP, and MMS settings however these you can get via http://www.sonyericsson.com/spg.jsp?...=pg&tl=support
select region then PHONE SETUP.

Finalization = Completing flashing operations and storing basic settings that phone needs to properly operate.

Firmware has two parts:
1. FS: Containing languages, images, sounds, animations, settings, etc. Anything that isn't pure software.
2. Main: Containing the base system software.

[TheRaf]

Doesn't work
i start the program
and a dos-window shows up and hides again ...

[TheRaf]

Program ends after saying:
Cannot open /COM7 at all [notebook]
Cannot open phone communication port: '/COM7'

Help me please