2 replies to this topic

[gani]

Branding: T-Mobile US
Subsidy Lock: LOCKED
Version: 1.1.4
Requires RSD Lite 4.5.7.
Requires SBF Recalc 1.2.9.1 to split.

http://rapidshare.co...stomer.zip.html

[MikLSP]

Thanks for that

I haven't looked into the CLIQ at all, can it be rooted?

[gani]

Asimple parser for the CG2. For now it can just extract the CG2 (let's not urge on repacking).
You need .NET 3.5 to run it.

How to use it:
A) Extract the CG2 from the firmware using the new SBF Recalc.
B) Extract the archive and put the CG2 into the same directory. Rename the CG2 to "CG2.smg"
C) Run the bat.

It will produce a pair of files:
*.mbn.header -> that is the header for the section
*.mbn -> that is the file binary

(there is one *.img file)

In the "*.mbn.header" files, there is on offset 0x2E4 the size of the "*.mbn" files (little endian).
"systemsec.mbn" is a yaffs2 image containing the system files. There is signature appended to it therefore if your yaffs2 extractor reports an error, open the file with hex editor, go to the end and search previous "FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF". Then delete everything after the end of the FFs + 0x40 bytes (40 is in HEX, 64 is in DEC). Then it should work flawlessly.

0x300 value is checksum. of the binary (calculated as inverted 32bit sum), 0x304 is checksum of the header.
Subsidy lock request removal will not work (As said in the previous post, more checksums need updating (amsssec.mbn; offset 0x578AFA). btw. it doesn't appear to be signed.
offset 0x300 - count all bytes in the binary and reverse it (32-bit sum)
offset 0x304 - count all bytes in the header, and put a single byte on the 0x304, so the 8-bit sum of the header is 0x00.
So these two checksums for amsssec.mbn must be updated.

Attached Files

•  AndroidCG2Parser.rar   3.32K   16 downloads