other

This page has been visited 39x till now.

other

In FAR Manager, always shutdown CSFS Loader correctly by '..' to apply patches correctly! Otherwise the phone will not boot (copy back file backup to fix corrupted file)! Connection in FAR might close after 5min of inactivity.

create/restore complete backup (DE)

Show my favorite J2ME / games

#ROMS emulator (elf)
Crash Bandicoot (GBA)
DonkeyKong, DidiKong (SEns9x)
games (NES)(GB)

#J2ME
Bounce (Tales)
Gravity Defied
Asphalt
IceAge
Gulo's Tale
Backgammon and similar
Bowling
Flipper
BrickBreaker + Sokoban
Sudoku 
Bubble shoot

#J2ME SW:
various emulator J2ME packs 
uC + Opera browser
torch jar for K810
jjpatcher
FS File manager
Bluetooth message sending (bloover?)

Get J2ME apps from here: J2ME links

Build own bluetooth remote control HID configuration (using SE SDK), like this one.

CID listhere or here
display types
firmware versions list
regio info / lang for A2 here or here

A2 dir structure

Acoustic- IFS/SETTINGS/ACOUSTIC
Camdriver - IFS/SETTINGS/CAMERA
Displaydriver - IFS/SETTINGS/DISPLAY
Flash Menu - TPA/PRESET/SYSTEM/DESKTOP/FLASH
Font - TPA/PRESET/SYSTEM/FONTS
Menu - TPA/PRESET/SYSTEM/MENU 
LNG - TPA/PRESET/SYSTEM/LANGUAGE

Paths in Filesystem (FS)

Camera-driver?
ifs/settings/camera/

Acoustic-driver (.apf)?
ifs/settings/acoustic/

Display-driver?
ifs/settings/display/

Where paste Custom-Files to?
tpa/preset/custom/

Activate default_upgrade.xml w/o Davinci-Trick?
Paste default_upgrade.xml to tpa/preset/default/

Wap-Profiles?
system/wap/profile/

Flashmenu (swf)?
tpa/preset/system/desktop/flash/

Bootscreen,Shutdownscreen?
tpa/preset/system/settings/

menu.ml?
tpa/preset/system/menu/

Walkman-Skins?
tpa/system/multimedia/mp/skin/

Fonts?
tpa/preset/system/fonts/

Languagepacks? (also T9)
tpa/preset/system/language/

installed j2me jar apps/games?
tpa/preset/system/ams

Finalization?
system/preset/custmenu/cust_menu_data.dat
system/preset/custmenu/cust_menu_done_unpacking.dat

Camera frame images?
tpa/preset/system/multimedia/pe/funlayer

Sound files?
tpa/preset/system/sound
Camera shutter sounds? Delete to mute
cameraburst.3gp
camerafocus.3gp
camerashutter.3gp
cameratimer.mid

font editing

Directory: tpa/preset/system/fonts

font must be in .ttf format.
Either rename the file extension from .ttf to .ltt and overwrite the original font,
or add the .ttf files and then reassign the filenames in fonts.xml.

Change the font sizes in Layout.xml.
Change font size when writing SMS:

edit your layout_mail.xml to this value. in other word, just change the value FontE_16 to FontE_10 in "StringInput" object

How to change logo/name of network

see tpa/preset/default/networklist.xml, e.g.:

  <network>
    <country>D</country>
    <mcc>262</mcc>
    <mnc>1</mnc>
 <longname>*change name*</longname>
 <shortname>*change name*</shortname>
    <multiplename>F</multiplename>
    <use3digits>F</use3digits>
  </network>

Use BleEditor 0.7 <insert here> to

Edit light effects

messaging.ble
MT_CALL.ble
power_down.ble
power_up.ble
REMINDER.ble = for events
SYSTEM.ble = effect for e.g. charging, headset or connecting data cable

backup walkman playlists

copy desired *.pml from tpa/system/multimedia/mp/pl

change A1 SMS storage location

change SMS storage location from "/smsdata" to "/tpa"
in
/ifs/settings/messaging/pref_store.txt
to have as much space for SMS as for data
PS: there is a patch for it too

To remove in phone write protected files

FS/tpa/user/theme => Desings
FS/tpa/user/image => Images
FS/tpa/user/audio => Sounds
FS/tpa/preset/system/sound => Sounds
FS/tpa/preset/system/messaging/sms/objects => SMS-Vorlagen
FS/tpa/preset/system/ams => Games and Apps
FS/tpa/preset/default/image => Images
FS/tpa/preset/default/audio => Sounds
FS/tpa/preset/system/multimedia/pe/clipart => Cliparts for PhotoDj
FS/tpa/preset/system/multimedia/pe/frames => Frames for PhotoDj
FS/tpa/preset/system/multimedia/pe/funlayer => Frames (from Cameramenu)
FS/tpa/preset/wizard => Images of Setup-Assistent

reset phone code to pin '0000'

to reset phone code to '0000', delete /tpa/preset/default/security_domain_settings.xml
probably only for k850i (which is one of the first A2 phones)
→ use omnius instead or just reflash firmware.

change CDA / debrand / finalize:

upload Customize.xml + preloaded_config.xml to /tpa/preset/custom instead of whole custpack before turning phone on.
if you forget, you will have to do a reset of your phone to make cda change take effect.
cust_menu_data.dat and cust_menu_done_unpacking.dat have cached .itm ad links (delete)

jjpatcher guide (CID80+)

PATCHING METHOD via jjpatcher (useful for DB3350 / CID80/CID81)

- Install 1-jjpatcher.jar, and move it to phone memory
- Run the app until this pop-up screen appear
- Install 2-jjpatcher.jad, and run it until the pop-up screen appears and press yes
- Now turn-off your phone, reinsert the battery and connect it to A2uploader.
- Upload customize_upgrade.xml to tpa/preset/custom
- Turn-on your phone and find phonememory/codeclaw/tpa/preset/system/ams/jab3b4ded00cb34b3cc77a6699f87ac10753fa701.b
Copy it to your PC and drag it onto bpatch.exe to patch it.
- Use A2uploader to copy patched jab3b4ded00cb34b3cc77a6699f87ac10753fa701.b to tpa/preset/system/ams/
- Boot your phone and now, it should be no pop-up screen that say you must patch the jab file.
- Copy your patches to phonememory/other/patches/
- Done, now your phone has been patched
- When the phone restarts jjpatcher will have to be re-run to apply all the patches again.

NOTE: jjpatcher has limits and may not run all patches! If you have phone upto CID53, brown your firmware.
EDIT: with jjpatcher+bpatch from farid it is even possible to load elfpack and other patches that have failed loading before - there is autoboot too.
jppatcher → load Elfloader → Elf (runtime_vkp) → apply patches

See https://github.com/farid1991/jjpatcher
and https://github.com/farid1991/bpatch
and https://github.com/farid1991/elfpack-se/tree/master/runtime_vkp

copy&paste when using phonebook

Copy & Paste when using phonebook:
Go into "Edit contact", and select the Contact
Scroll down to the number you want to cut and paste.
Without selecting it (ie without clicking on the joystick or the yes button) press and hold the * key, and then press the 1 key. When you release both keys, the highlighted number should disappear
Now move to the appropriate entry (eg the "Mob" entry) and press and hold the * key, then press the 3 key. When you release both, the number is pasted into this entry. (1 for cut, 2 for copy and 3 for paste)

If you've cleared your call list you can easily find unsaved dialed no:
Go to Message then Write New & Press yes. Click on Continue. In the menu to let you key in the number to send msg, press the right up key for more menu & you go to the following list.
Phone book, Groups, Sim entries and Unsaved nos.
Select Unsaved nos, there you will see last 10 unsaved number.
Those numbers can't be erased even you clear your entire call list.

smilies

    Here are some of hidden smilies for messages. You wont find them in “Add symbol” without patch

    1. :-]
    2. :-[
    3. :-*
    4. [:]
    5. :<^
    6. ://
    7. :&
    8. :'(

user agent strings

#user agent strings from other browsers:

SonyEricssonJ108i/R7EA Profile/MIDP-2.1 Configuration/CLDC-1.1 UNTRUSTED/1.0-1.1; Opera Mini/att/4.2<br>
SonyEricssonJ108i/R7EA Profile/MIDP-2.1 Configuration/CLDC-1.1 UNTRUSTED/1.01.1; Opera Mini/att/4.2.<br>
SonyEricssonK618i/R1JG Profile/MIDP-2.0 Configuration/CLDC-1.1 UNTRUSTED/1.0<br>
SonyEricssonW830i/R1KG Profile/MIDP-2.0 Configuration/CLDC-1.1 UNTRUSTED/1.01.1; Opera Mini/att/4.2.<br>

Re: How to change the CID81 to CID53???

    1. you need change OTP ic to blank one
    2. you need to have special cable ( on vppflash pin should be supplied voltage +7.5v )
    3. you need to have recent setool2 version
    4. go to emptyboard tab, fill imei,select cid, check "write otp" , press unlock.

    operation done as any other operation with phone.

repair EROM dead redlight blinking

  Start SeTool 2 lite
  Press Unlock\Repair Button
  Reinsert charged Battery
  Connect phone holding 2+5
  Wait, SeTool 2 lite will repair the EROM, it will flash it back.
  Done
  
  Alternatively, try to flash Firmware (NOT FS!)

official Sony Ericsson files: se-official.zip (4x downloaded)

zip file content

├── 71477-BTRemoteControl-v4.01.b1.3.exe
├── 75565-PIM_DEMO_ReoccurringEvent.zip
├── 96958-semc_java_me_cldc_sdk_2_5_0_readme.html
├── 99962-semc_java_me_cldc_sdk_2_5_0_6.zip
├── AT_commands
│   ├── DW-65054-dg_at_2006--10_r17a.pdf
│   └── source.txt
├── Capuchin
│   ├── 101178-CapuchinKit-4.2-Win.zip
│   ├── 101179-tutorial_capuchin_getstarted_flash_r2b2.zip
│   └── 101216-capuchin.service.generator_4.0.0.zip
├── LZN_9010453_R1A_CertificatesAndLoaders.pdf
├── sony-ericsson-c901-greenheart_engels.pdf
└── wp_uaprof_r6a.pdf

Prototype code names: sony_ericsson_phone_types.pdf
Mgmaps info: mgmaps_stored_maps_spec_150408_v1_0.pdf
MMR70 schematics: mmr70_schematics.pdf

SBN Tool

SBN Tool: Sony Ericsson SBN firmware converter and patcher.
SBN firmware is based on the Motorola S-Record format, used by Ericsson and Sony Ericsson phones with AVR chipset such as T28, T68i, T610, T630, etc.

src:
https://github.com/farid1991/sbntool

Using flashing tools in VM (e.g. VirtualBox) is tricky, as SEMCBOOT is time sensitive and reconnects in between. Make sure you use USB2.0 (not USB3 xHCI) and redirect all needed USB-IDs, set generic filters. Also try out using a USB2.0 hub. You might need to block USB init on host.
I could not manage to get it to work with T460/T480 and VirtualBox v7 - I could have sworn that it has worked in the past, either on T450 or Sony Vaio.

FW specific

Tree/map of entire A2 FS (C902) from se-lifestyle <insert file>

Crossflash: https://my-se.ucoz.net/forum/58-124-1

cam drivers

Raider by raiderski and documentation

Software

readcontact_1.6_from_gdfs.rar
ms_pro_duo_format.rar

serial python tool: https://github.com/farid1991/sepytool/ or fork of fixeria with args parser cleanup + better logging
SBN Tool: https://github.com/farid1991/sbntool
FAR manager OBEX plugin: https://github.com/d4rkmen/PhoneFS

JAR

K800/K810 torch: torch_v1.0_k800-k810.zip

Informative

Sony Ericsson Elm (J10i2) and Hazel (J20i) are the latest A2 phones (DB3310). Saito (J117i) and Anino (J105i) are actually Symbian^3 (S60).

Show nice to know info

- Connect with blueman (linux) to phones network connection. Speed is limited to Bluetooth 2.0 ESR (~2 Mbps), which is ok-ish for browsing with adblocker. Send SMS under linux with gnokii or Gnome Phone Manager (GUI)
- Use mobile or pocket versions of websites for your phone like pocket.dict.cc and http://sonyericsson.org:64/ Youtube 2009 with its settings
- There is runtime patching via jar (jjpatcher+bpatch).
- 'T28' connector is so called because it was the first phone it came with.
- Join patches in single .vkp by adding +0; between patches, which just resets the offset value.
- Modified DSS-20/25 can be used for phones with T28 Connector as serial adapter. (DSS is strictly FTDI232 VID_0403&PID_FC82)
- EMMA (Ericsson Mobile Maintenance Application) was the manufacturers service tool
- Ericsson Equipment List
- Ericsson A2618 Trouble shooting guide
- The radio antenna is the cable of the headphones. The “no headphone” patch will give you no radio signal w/o antenna on fastport.
- OS base is ENEA OSE | - some codenames of unreleased phones
- when resetting phone from menu, you will lose some preinstalled themes, sounds, games, demovideo and more. Backup them first or try to find a download via the links.
- remove ad-links from cust pack or remove from FS afterwards
- there was a challenge in 2010 called “DFRWS2010”
- somebody created a tribute to Music DJ on github
- there are NES, SEns9x (i've modded input bcfg controls), GBA elf emulators - and DOOM. There are even J2ME emulators for more, older consoles. Plus the J2ME-games itself. tons to play with^^
- DB2020 was the last SE platform that allowed raw firmware patching without signed loaders. QA QuickAccess patch available for DB2020 (and some PNX5230 variants?)
Later A2 platforms (DB3150+) have more secure bootloaders, stricter signature enforcement, different memory layouts, paid CID53 unlock (Update: Omnius now free!) and still uncracked CID80+.
- /boot/pcore.cxc is located by address, not by path. It's first file on firmware. Re-uploaded pcore has a different address and phone won't work, because phone won't find pcore.
- Flash wallpaper on W800i possible in extremely buggy R1L002 FW, but not in R1NA002
- there are exclusive models for Japanese market
- Sony Ericsson Xperia X5 Pureness has a transparent screen. they enclosured the LCD without backlight panel and added LED(s?) on edge. It is one of the costly traded, rarest SE phones (besides prototypes)
- Buy µSD-card adapter for MemoryStick (also dual SD); works well with SE phones and Sony PSP (except for PSP recovery with pandora battery due to no real MagicGate MemoryStick); adapter has ASIC inside; needs reformatting in dual µSD-card mode;
- A list of all accessories from Sony Ericsson can be found on english wikipedia. There even was a hybrid smartwatch, RC-car, FM-transmitter, Gameboard, etc.
- see Links modification to find out that MMR-70 FM transmitter (3,68MHz oscillator) and MRC-60 iR-dock use ATmega168V MCU | Convert to USB-C
- mod/solder MPS-Series speaker fastport to USB-A+3.5mm (✅ done) (or even USB-C with analog audio?)
- headset HPM-90 has an OLED screen and HPM-100 has GPS builtin. There is a trrs 3.5mm version of HPM-77/J. MW-600 is the most famous bluetooth-headset from SE. Its successors are SBH-54 and SBH-56 (SBH-20).
- There are fastport to 3.5mm audio jack adapter aftermarket cables
- Buy a Memory Stick Micro (M2) USB cardreader (CCR-70). M2 micro is a shrunk down MemoryStick, they are electrically the same.
- SE Yari was called Kita in Philippines
- Accelerometer of A1 only has X+Y axis, whereas A2 has X+Y+Z
- LED-flash is dim-able for A1 phones but not for A2.

Project ideas:
- There is no internal/detailed info on MXE-60 or MPF-10 camera flash. Somebody should disassemble, create schematics, use logic analyzer *¿note to self?*
- Create iR-codes list for MRC-60 dock
- decode title info on fastport (of HPM-90) with logic analyzer: create DIY HPM-90
- custom PCB for USB-C with bidirectional power (and audio 3.5mm for HPM-77/J or MH-810?) on C901
- M2 to µSD-card PCB conversion with ASIC from disassembled adapter
- PCB with MCU and MOSFET for limiting A2 LED flash brightness; communication over GPIO signal sequence, triggered by TorchC901 elf; hw-integration of unsupported camera flash on fastport/T28
- USB-C plug with analog audio as mod for MPS-Series speaker and HPM-headset remote controls
- USB-C socket conversion on MW600/SBH-54

Key combinations

>*<<*<* opens service menu (read IMEI, software info, hw-tests)
press * before+while putting in battery then cable (e.g. DCU-60) for Service/Test Mode
Purpose: Used for flashing, patching, GDFS access, TEMS activation, etc.
press 2+5 combined before+while putting in battery then cable = Update Mode (a.k.a. SEUS Mode)
Purpose: Used for official firmware updates via Sony Ericsson Update Service (SEUS) or tools that mimic it (e.g., Omnius)
<**< (un)lock phone onto the network(subset), Enter NCK number (provided by SP)

IMEI info

*#06# to view IMEI (International Mobile Equipment Identity)
Configuring the IMEI number
Sony Ericsson like this
XXXXXX XX XXXXXX X
TAC FAC SNR SP

TAC = Type approval code of your sony
Ericsson Mobile
FAC = Final assembly code of your
cellphone
SNR = Serial number of your sony
Ericsson Phone
SP = Spare

easter-egg: in service menu, go to Service Info → Model Info, then press the joystick up/down repeatedly (usually 11 times or more) to read "Sony Ericsson rocks!"

Useful netprovider commands

This may me regional and varies with network provider. On O2/EPlus/Drillisch try the following ones:

AT command list

~~<insert here>~~

Use AT to add 2G communication to your microcontroller project with (an even elfpack enabled) phone.

Sony Ericsson MW600:

Demo Mode: put the MW600 in pairing mode → keep the play button pressed until the demo mode starts
Test Mode: put the MW600 in pairing mode → press the call button 5 times and continue pressing it several times to cycle through different screens

TEMS FW

Sony Ericsson A1 Techmode

TEMS (Test Mobile System) firmware is a special diagnostic and engineering firmware variant developed by Ericsson (and later Ascom, then Keysight).
https://archives.kaijousuru.com:9999/?dir=Sony%20Ericsson\TEMS%20Pocket
https://cosconor.fr/GSM/Nokia/Netmonitor/TEMS/* K800i/ and * T68 + T610/

phones with TEMS fw

Sony Ericsson K790a    N/A
Sony Ericsson K790i    R2B
Sony Ericsson W995    R1K
Sony Ericsson C702    R1E
Sony Ericsson C905    R1D
Sony Ericsson C905a    R1D
Sony Ericsson K800i    R2B
Sony Ericsson TM506    R1E
Sony Ericsson W760i    R1E
Sony Ericsson Z750i    R1F

sedbgmux - DebugMux client
fixeria's reverse engineering DebugMux protocol and its video version on media.ccc.de

missing stuff / lost media

If you have/know any of the following files/info, pls let me know.

lost stuff I know of

MISSING elfpack-libraries:  http://archive.is/LT69I
SimpleBiorhythm
MinesweeperClone
BreakCountdown
AutoShutdown

CODECLAW + Info Pages

A2 Acoustics Editor (A2AE)
SWF Info (SI)
Sony Ericsson Layout Editor (SELE)
AVX Editor (AE)
Walkman 2.0 Patch Generator (W2PG)
Walkman 2.0 Skin editor (W2SE)
(FrontPaw) Extension Manager (EM)

flash-menu-theme-connector FM + THM Joiner.rar: https://web.archive.org/web/20130831080505/http://forums.se-nse.net/topic/50127-flash-menu-theme-connector/

https://web.archive.org/web/20120210094904/http://www.cybershut.com/archives/880

Mascot Capsule game Engine
phone emulator: https://www.youtube.com/watch?v=nLQpXbNyAH4

se-stuff.net stuff
+tons of theme packs

Info about which service cables with smartcards are still active.

Omnius server-side-software (release as non_functional w/o DB! for RE)
Omnius source code

Table of Contents