Patches are saved as .vkp format, which is a renamed text file with description patch itself. Each patch line should start with an +offset to which address it is patched. You can revert patches as original content is first part after offset every line.
You can join patches into a single .vkp by adding +0 between two patches, which just resets the offset value. Comments are done with “;” in front till end of line
'must have' patches:
If you don't have SIM inside when you work on your phone, install patch for no SIM first.
See if there is are heapshift patches and apply the needed one.
Patch elfpack from https://justdanpo.ru/data/support/elfpack/, or see Farids versions. Elfloader is the only thing you'll really need.
On DB2020 flash QuickAccess (QA) vkp - mandatory for way faster connection for patching.
Tip: Copy/backup CXC in a state you have liked, then you do not have to reflash complete FW when you screw up patching. You can get clean cxc by extracting MAIN fw. If you use FAR manager for patching VKP, there is always a cached version locally: AppData\Roaming\farcxcpatcher\cache
Warning: I am not responsible. You can brick your phone (then just try to reflash). This is no guide, just a collection. Go read the warnings of everybody else, they apply here too.
If you use runtime vkp, don't make it as Daemon
Downside already told by iron master in his original thread in mobilefree.
Runtime vkp cant use heap address, so if the patch use heap it need to be rewritten.
If you use runtime vkp, don't make it as Daemon (don't do runtimevkp as daemon)
It look like has race condition that make phone crash.
Its very useful for testing patch on the fly 😅
I'm already using offline pather in farcxcpatcher, I can open phone_app and drag patches there.
ALWAYS make a backup your personal GDFS - FIRST!
See Link collection to find downloads.
Learn how to port patches yourself if you want to. Do not start with patch creating, as you need to search and add hooks manually by looking inside firmware target. If you are new to all this, start programming elf first (it is much easier bc you do not need to know about hooks and offsets in firmware. If you want to create patches, first learn about patch porting and arm assembler (thumb instruction for most part of firmware).
To start patch porting, see these 4 video tutorials on YT made by blacklizard:
https://www.youtube.com/watch?v=oDMDYai_Up0
https://www.youtube.com/watch?v=mG5Dj9EhkSU
https://www.youtube.com/watch?v=8OFonc2gkXM
https://www.youtube.com/watch?v=2iQrq8wgNY0
Patch porting tools downloaded somewhere 2011:
patch_porting_tools.zip
Get relevant tools from https://justdanpo.ru/data/projects/gsm/
use “read3150” also for DB3210 to retreive phone_app.cxc and use ida_cxcldr to open it in IDA
there is no .raw for A2, only for DB2010/20 (for which you use GExtract, main2raw and babe2raw)
VKP means V_Klay Patch which is taken from a patcher tool for Siemens known as V_Klay Patcher.
Download idc.rar: icd-download downloaded x times
Download ARM Patch Compiler.rar: A GUI for Armpc (by Edgpaez on 17 Jan 2009): downloaded x times
Entrypoint Converter 1.1
There is a new version of elf2vkp: https://github.com/siemens-mobile-hacks/elf2vkp
There is a safer method than using heap for patches (explained by denpo on mobilefree): #TODO: insert link (I've lost it..)
se-developers.net archived links:
[Tutorial] Porting and Compiling ASM files
using Smelter
VKP Patch Structure
[Tutorial] Making ASM File
[Tutorial] Advanced patch porting
Porting Lib Functions
Open Firmware with IDA
Calculate phone_app base address
ARM Assembly
Writing patch in IAR and using elf2vkp?
findbl_IDA-Plugin
http://www.se-developers.net/viewtopic.php?f=38&t=250
Also see se-developers.net archive
Find more, usefull stuff at mobilefree
#TODO: upload translated patches
In 2015 I have collected and saved all available patches on mobilefree.ru for C901 and google translated the non-english descriptions. I've repeated it with other forums.
c901_patches_mobilefree-2016.zip
Mandatory patches:
heapshift
elfpack
No-SIM patch
Keylock popup removal
video camera light as torch fix → see my torch elf “Torch901”
Some patches need Drawstring fix and int2strid fix
I for myself joined the patches separated by '+0' and always flashed as a bunch. Following Is my personal archive of plugins for C901:
#TODO: add dl-link
I did not go so deep with K800, but I want to share the messy collection of my HDD anyways.
Mandatory patches:
On DB2020, flash fast access vkp. mandatory for way faster connection for patching.
Tartes mod elfpack 1.9.2 ?
Heapshift
No-SIM patch
red-led flashlight + key-trigger customization and jar lcd-screen colour light
Joystick workaround
#TODO: add dl-link
Following is the little stuff I have found on my HDD.
#TODO: add dl-link