Re: Downgrade и восстановление IMEI на BB5
#31
Best method is FULL FLASH erase and restoring with original Nokia rpl file!
Otherwise....
I didn't play much with that problem but you can try...
All test are made with 6630, probably it works with other BB5
MCU & DSP signatures are stored in 308,1 field on subblock
"ab0fbd96af2ac271d26264af dead 06 00"
That subblock is crypted by AES algorithm, and you have to know 16bytes key
or to use attack to make change on that subblock.
But...
To make simple SW update Nokia made some backdors.
Rap is testing that subblock and if new SW is newer than SW signature in
that subbblock RAP will update subblock with newer SW signature.
Otherwise, if new SW is older, RAP will STOP.
BUT if that subblock is corupted RAP will write default current SW signature!!!
So, procedure is next:
Power your BB5 phone.
After few sec. read field 308,1
Find in readed field 308,1 bytes "ab0fbd96af2ac271d26264afdead0600"
and after that header fill next 16 bytes with zeros.
Write back that new field 308,1 to phone.
Well why Nokia made that after writing new fild 308,1 it is not tested...
Anyway new field is stored in FLASH and it will be tested on NEXT phone reset!!!
Here is more critical part.
You have to flash phone with older SW before phone SW reset!!!
You have to find flasher that allows very fast entering phone in FLASH mode!!!
(if flasher after powering phone gives to much time to RAP start SW testing,
SW downgrade will faill!)
If every thing goes ok after flashing ,RAP will find corrupted subblock
and will authorise previous wrote downgraded SW!
That's it.
B.R.
Dejan
Скопировал,что б лишний раз не искать.
Последние файлы
