This page has been visited {{counter|total}}x till now. \\ ====== other ====== In FAR Manager, always shutdown CSFS Loader correctly by '..' to apply patches correctly! Otherwise the phone will not boot (copy back file backup to fix corrupted file)! Connection in FAR might close after 5min of inactivity. \\ [[https://web.archive.org/web/20080622030328/http://www.se-world.info/thread167132-Full-Backup-der-kompletten-Firmware-erstellen-zurueckspielen.html|create/restore complete backup (DE)]] \\ #ROMS emulator (elf) Crash Bandicoot (GBA) DonkeyKong, DidiKong (SEns9x) games (NES)(GB) #J2ME Bounce (Tales) Gravity Defied Asphalt IceAge Gulo's Tale Backgammon and similar Bowling Flipper BrickBreaker + Sokoban Sudoku Bubble shoot #J2ME SW: various emulator J2ME packs uC + Opera browser torch jar for K810 jjpatcher FS File manager Bluetooth message sending (bloover?) Get J2ME apps from here: [[sony_ericsson:links#J2ME|J2ME links]]\\ CID list[[http://www.sonyericsson-world.com/topic/7121-cid-what-is-it-what-cid-has-my-phone/|here]] or [[https://www.topsony.com/forum/cmps_index.php?page=cid_es|here]] \\ [[http://www.sonyericsson-world.com/topic/1419-what-display-is-in-my-model/|display types]] \\ [[http://www.sonyericsson-world.com/topic/1651-firmware-list-for-sony-ericsson-phones/|firmware versions list]] \\ regio info / lang for A2 [[http://www.sonyericsson-world.com/topic/1079-regions-and-languages-for-a2-phones/|here]] or [[http://www.topsony.com/forum/cmps_index.php?page=info_lenguaje|here]] \\ Acoustic- IFS/SETTINGS/ACOUSTIC Camdriver - IFS/SETTINGS/CAMERA Displaydriver - IFS/SETTINGS/DISPLAY Flash Menu - TPA/PRESET/SYSTEM/DESKTOP/FLASH Font - TPA/PRESET/SYSTEM/FONTS Menu - TPA/PRESET/SYSTEM/MENU \\ Camera-driver? ifs/settings/camera/ Acoustic-driver (.apf)? ifs/settings/acoustic/ Display-driver? ifs/settings/display/ Where paste Custom-Files to? tpa/preset/custom/ Activate default_upgrade.xml w/o Davinci-Trick? Paste default_upgrade.xml to tpa/preset/default/ Wap-Profiles? system/wap/profile/ Flashmenu (swf)? tpa/preset/system/desktop/flash/ Bootscreen,Shutdownscreen? tpa/preset/system/settings/ menu.ml? tpa/preset/system/menu/ Walkman-Skins? tpa/system/multimedia/mp/skin/ Fonts? tpa/preset/system/fonts/ Languagepacks? (also T9) tpa/preset/system/language/ installed j2me jar apps/games? tpa/preset/system/ams Finalization? system/preset/custmenu/cust_menu_data.dat system/preset/custmenu/cust_menu_done_unpacking.dat Camera frame images? tpa/preset/system/multimedia/pe/funlayer Sound files? tpa/preset/system/sound Camera shutter sounds? Delete to mute cameraburst.3gp camerafocus.3gp camerashutter.3gp cameratimer.mid Directory: tpa/preset/system/fonts font must be in .ttf format. Either rename the file extension from .ttf to .ltt and overwrite the original font, or add the .ttf files and then reassign the filenames in fonts.xml. Change the font sizes in Layout.xml. Change font size when writing SMS: edit your layout_mail.xml to this value. in other word, just change the value FontE_16 to FontE_10 in "StringInput" object see tpa/preset/default/networklist.xml, e.g.: D 262 1 *change name* *change name* F F Use BleEditor 0.7 to messaging.ble MT_CALL.ble power_down.ble power_up.ble REMINDER.ble = for events SYSTEM.ble = effect for e.g. charging, headset or connecting data cable copy desired *.pml from tpa/system/multimedia/mp/pl change SMS storage location from "/smsdata" to "/tpa" in /ifs/settings/messaging/pref_store.txt to have as much space for SMS as for data PS: there is a patch for it too FS/tpa/user/theme => Desings FS/tpa/user/image => Images FS/tpa/user/audio => Sounds FS/tpa/preset/system/sound => Sounds FS/tpa/preset/system/messaging/sms/objects => SMS-Vorlagen FS/tpa/preset/system/ams => Games and Apps FS/tpa/preset/default/image => Images FS/tpa/preset/default/audio => Sounds FS/tpa/preset/system/multimedia/pe/clipart => Cliparts for PhotoDj FS/tpa/preset/system/multimedia/pe/frames => Frames for PhotoDj FS/tpa/preset/system/multimedia/pe/funlayer => Frames (from Cameramenu) FS/tpa/preset/wizard => Images of Setup-Assistent > to reset phone code to '0000', delete /tpa/preset/default/security_domain_settings.xml > probably only for k850i (which is one of the first A2 phones) > -> use omnius instead or just reflash firmware. change CDA / debrand / finalize: \\ > upload Customize.xml + preloaded_config.xml to /tpa/preset/custom instead of whole custpack before turning phone on. > if you forget, you will have to do a reset of your phone to make cda change take effect. > cust_menu_data.dat and cust_menu_done_unpacking.dat have cached .itm ad links (delete) PATCHING METHOD via jjpatcher (useful for DB3350 / CID80/CID81) - Install 1-jjpatcher.jar, and move it to phone memory - Run the app until this pop-up screen appear - Install 2-jjpatcher.jad, and run it until the pop-up screen appears and press yes - Now turn-off your phone, reinsert the battery and connect it to A2uploader. - Upload customize_upgrade.xml to tpa/preset/custom - Turn-on your phone and find phonememory/codeclaw/tpa/preset/system/ams/jab3b4ded00cb34b3cc77a6699f87ac10753fa701.b Copy it to your PC and drag it onto bpatch.exe to patch it. - Use A2uploader to copy patched jab3b4ded00cb34b3cc77a6699f87ac10753fa701.b to tpa/preset/system/ams/ - Boot your phone and now, it should be no pop-up screen that say you must patch the jab file. - Copy your patches to phonememory/other/patches/ - Done, now your phone has been patched - When the phone restarts jjpatcher will have to be re-run to apply all the patches again. NOTE: jjpatcher has limits and cannot run all patches! If you have phone upto CID53, brown your firmware. Copy & Paste when using phonebook: Go into "Edit contact", and select the Contact Scroll down to the number you want to cut and paste. Without selecting it (ie without clicking on the joystick or the yes button) press and hold the * key, and then press the 1 key. When you release both keys, the highlighted number should disappear Now move to the appropriate entry (eg the "Mob" entry) and press and hold the * key, then press the 3 key. When you release both, the number is pasted into this entry. (1 for cut, 2 for copy and 3 for paste) If you've cleared your call list you can easily find unsaved dialed no: Go to Message then Write New & Press yes. Click on Continue. In the menu to let you key in the number to send msg, press the right up key for more menu & you go to the following list. Phone book, Groups, Sim entries and Unsaved nos. Select Unsaved nos, there you will see last 10 unsaved number. Those numbers can't be erased even you clear your entire call list. Here are some of hidden smilies for messages. You wont find them in “Add symbol” without patch 1. :-] 2. :-[ 3. :-* 4. [:] 5. :<^ 6. :// 7. :& 8. :'( #user agent strings from other browsers: SonyEricssonJ108i/R7EA Profile/MIDP-2.1 Configuration/CLDC-1.1 UNTRUSTED/1.0-1.1; Opera Mini/att/4.2
SonyEricssonJ108i/R7EA Profile/MIDP-2.1 Configuration/CLDC-1.1 UNTRUSTED/1.01.1; Opera Mini/att/4.2.
SonyEricssonK618i/R1JG Profile/MIDP-2.0 Configuration/CLDC-1.1 UNTRUSTED/1.0
SonyEricssonW830i/R1KG Profile/MIDP-2.0 Configuration/CLDC-1.1 UNTRUSTED/1.01.1; Opera Mini/att/4.2.
 1. you need change OTP ic to blank one 2. you need to have special cable ( on vppflash pin should be supplied voltage +7.5v ) 3. you need to have recent setool2 version 4. go to emptyboard tab, fill imei,select cid, check "write otp" , press unlock. operation done as any other operation with phone. Start SeTool 2 lite Press Unlock\Repair Button Reinsert charged Battery Connect phone holding 2+5 Wait, SeTool 2 lite will repair the EROM, it will flash it back. Done \\ official Sony Ericsson files: {{ :sony_ericsson:other:se-official.zip |}} ({{dlcounter>file?sony_ericsson:other:se-official.zip}}x downloaded) ├── 71477-BTRemoteControl-v4.01.b1.3.exe ├── 75565-PIM_DEMO_ReoccurringEvent.zip ├── 96958-semc_java_me_cldc_sdk_2_5_0_readme.html ├── 99962-semc_java_me_cldc_sdk_2_5_0_6.zip ├── AT_commands │   ├── DW-65054-dg_at_2006--10_r17a.pdf │   └── source.txt ├── Capuchin │   ├── 101178-CapuchinKit-4.2-Win.zip │   ├── 101179-tutorial_capuchin_getstarted_flash_r2b2.zip │   └── 101216-capuchin.service.generator_4.0.0.zip ├── LZN_9010453_R1A_CertificatesAndLoaders.pdf ├── sony-ericsson-c901-greenheart_engels.pdf └── wp_uaprof_r6a.pdf \\ Prototype code names: {{ :sony_ericsson:other:sony_ericsson_phone_types.pdf |}} \\ Mgmaps info: {{ :sony_ericsson:other:mgmaps_stored_maps_spec_150408_v1_0.pdf |}} \\ MMR70 schematics: {{ :sony_ericsson:other:mmr70_schematics.pdf |}} \\ ===== FW specific ===== Tree/map of entire A2 FS (C902) from se-lifestyle \\ Crossflash: [[https://my-se.ucoz.net/forum/58-124-1]] \\ ===== Software ===== {{ :sony_ericsson:other:readcontact_1.6_from_gdfs.rar |}} \\ {{ :sony_ericsson:other:ms_pro_duo_format.rar |}} \\ serial python tool: [[https://gitea.osmocom.org/fixeria/sepytool]] \\ FAR manager OBEX plugin: [[https://github.com/d4rkmen/PhoneFS]] \\ ==== JAR ==== K800/K810 torch: {{ :sony_ericsson:other:jar:torch_v1.0_k800-k810.zip |}} ===== Informative ====== Sony Ericsson Elm (J10i2) and Hazel (J20i) are the latest A2 phones (DB3310). Saito (J117i) and Anino (J105i) are actually Symbian^3 (S60). \\ - Connect with blueman (linux) to phones network connection. Speed is limited to Bluetooth 2.0 ESR (~2 Mbps), which is ok-ish for browsing with adblocker. Send SMS under linux with //gnokii// or //Gnome Phone Manager// (GUI) \\ - Use mobile or pocket versions of websites for your phone like [[pocket.dict.cc]] and [[http://sonyericsson.org:64/]] Youtube 2009 with [[http://sonyericsson.org:64/mobile/playback_setup.htm|its settings]] \\ - There is runtime patching via jar (jjpatcher+bpatch). \\ - 'T28' connector is so called because it was the first phone it came with. \\ - Join patches in single .vkp by adding **+0**; between patches, which just resets the offset value. \\ - [[sony_ericsson:links#modifications|Modified DSS-20]]/25 can be used for phones with T28 Connector as serial adapter. (DSS is strictly FTDI232 [[https://github.com/xcp-ng/qemu-dp/blob/master/hw/usb/quirks-ftdi-ids.h#L442|VID_0403&PID_FC82]])\\ - [[https://web.archive.org/web/20100801070404/http://ma3.extranet.sonyericsson.com/|EMMA (Ericsson Mobile Maintenance Application)]] was the manufacturers service tool \\ - [[https://altehandys.de/downloads/ser-se-z600-equipment-list.pdf|Ericsson Equipment List]] \\ - [[https://altehandys.de/downloads/ser-man-er-a2618sc.pdf|Ericsson A2618 Trouble shooting guide]] \\ - The radio antenna is the cable of the headphones. The "no headphone" patch will give you no radio signal w/o antenna on fastport. \\ - [[https://featurephone-os.github.io/2023/05/10/enea-ose.html|OS base is ENEA OSE]] | - some [[https://web.archive.org/web/20160201162315/https://jjlifeblog.wordpress.com/home/|codenames of unreleased phones]] \\ - when resetting phone from menu, you will lose some preinstalled themes, sounds, games, demovideo and more. Backup them first or try to find a download via [[sony_ericsson:links|the links]]. \\ - remove ad-links from cust pack or remove from FS afterwards \\ - there was a challenge in 2010 called "[[https://github.com/dfrws/dfrws2010-challenge|DFRWS2010]]" \\ - somebody created a tribute to [[https://pattlebass.github.io/Music-DJ/|Music DJ on github]] \\ - there are NES, [[https://mobilefree.justdanpo.ru/newbb_plus/viewtopic.php?topic_id=4502|SEns9x]] (i've modded input bcfg controls), [[https://mobilefree.justdanpo.ru/newbb_plus/viewtopic.php?topic_id=4241|GBA]] elf emulators - and [[https://mobilefree.justdanpo.ru/newbb_plus/viewtopic.php?topic_id=4750&post_id=164210|DOOM]]. There are even J2ME emulators for more, older consoles. Plus the J2ME-games itself. tons to play with^^ \\ - DB2020 was the last SE platform that allowed raw firmware patching without signed loaders. QA QuickAccess patch available for DB2020 (and some PNX5230 variants?) \\ Later A2 platforms (DB3150+) have more secure bootloaders, stricter signature enforcement, different memory layouts, paid CID53 unlock (Update: Omnius now free!) and still uncracked CID80+. \\ - /boot/pcore.cxc is located by address, not by path. It's first file on firmware. Re-uploaded pcore has a different address and phone won't work, because phone won't find pcore. \\ - Flash wallpaper on W800i possible in extremely buggy R1L002 FW, but not in R1NA002 \\ - there are exclusive models for Japanese market \\ - Sony Ericsson Xperia X5 Pureness has a transparent screen. they enclosured the LCD without backlight panel and added LED(s?) on edge. It is one of the costly traded, rarest SE phones (besides prototypes) \\ - Buy µSD-card adapter for MemoryStick (also dual SD); works well with SE phones and Sony PSP (except for PSP recovery with pandora battery due to no real MagicGate MemoryStick); adapter has ASIC inside; needs reformatting in dual µSD-card mode; \\ - A list of all accessories from Sony Ericsson can be found on [[https://en.wikipedia.org/wiki/List_of_Sony_Ericsson_products#Accessories|english wikipedia]]. There even was a hybrid smartwatch, RC-car, FM-transmitter, Gameboard, etc. \\ - see [[sony_ericsson:links#modifications|Links modification]] to find out that MMR-70 FM transmitter (3,68MHz oscillator) and MRC-60 iR-dock use ATmega168V MCU | Convert to USB-C \\ - mod/solder MPS-Series speaker fastport to USB-A+3.5mm (✅ done) (or even USB-C with analog audio?) \\ - headset HPM-90 has an OLED screen and HPM-100 has GPS builtin. There is a trrs 3.5mm version of HPM-77/J. MW-600 is the most famous bluetooth-headset from SE. Its successors are SBH-54 and SBH-56 (SBH-20).\\ - There are fastport to 3.5mm audio jack adapter aftermarket cables \\ - Buy a Memory Stick Micro (M2) USB cardreader (CCR-70). M2 micro is a shrunk down MemoryStick, they are electrically the same. \\ - Accelerometer of A1 only has X+Y axis, whereas A2 has X+Y+Z \\ - LED-flash is dim-able for A1 phones but not for A2. \\ \\ **__Project ideas:__** \\ - There is no internal/detailed info on MXE-60 or MPF-10 camera flash. Somebody should disassemble, create schematics, use logic analyzer *¿note to self?* \\ - Create iR-codes list for MRC-60 dock \\ - decode title info on fastport (of HPM-90) with logic analyzer \\ - custom PCB for USB-C with bidirectional power (and audio 3.5mm for HPM-77/J or MH-810?) on C901 \\ - M2 to µSD-card PCB conversion with ASIC from disassembled adapter \\ - PCB with MCU and MOSFET for limiting A2 LED flash brightness; communication over GPIO signal sequence, triggered by TorchC901 elf; hw-integration of unsupported camera flash on fastport/T28\\ - USB-C plug with analog audio as mod for MPS-Series speaker and HPM-headset remote controls\\ - USB-C socket conversion on MW600/SBH-54 \\ \\ ==== Key combinations ==== >*<<*<* opens service menu (read IMEI, software info, hw-tests) \\ press * before+while putting in battery then cable (e.g. DCU-60) for Service/Test Mode \\ Purpose: Used for flashing, patching, GDFS access, TEMS activation, etc. \\ press 2+5 combined before+while putting in battery then cable = Update Mode (a.k.a. SEUS Mode) \\ Purpose: Used for official firmware updates via Sony Ericsson Update Service (SEUS) or tools that mimic it (e.g., Omnius) \\ <**< (un)lock phone onto the network(subset), Enter NCK number (provided by SP) \\ *#06# to view IMEI (International Mobile Equipment Identity) Configuring the IMEI number Sony Ericsson like this XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type approval code of your sony Ericsson Mobile FAC = Final assembly code of your cellphone SNR = Serial number of your sony Ericsson Phone SP = Spare easter-egg: in service menu, go to Service Info → Model Info, then press the joystick up/down repeatedly (usually 11 times or more) to read "Sony Ericsson rocks!" This may me regional and varies with network provider. On O2/EPlus/Drillisch try the following ones: **** Use AT to add 2G communication to your microcontroller project with (an even elfpack enabled) phone. \\ > Demo Mode: put the MW600 in pairing mode -> keep the play button pressed until the demo mode starts > Test Mode: put the MW600 in pairing mode -> press the call button 5 times and continue pressing it several times to cycle through different screens \\ ==== TEMS FW ==== [[https://phoneftd.blogspot.com/2008/08/sony-ericsson-techmode.html|Sony Ericsson A1 Techmode]] \\ TEMS (Test Mobile System) firmware is a special diagnostic and engineering firmware variant developed by Ericsson (and later Ascom, then Keysight). \\ [[https://archives.kaijousuru.com:9999/?dir=Sony%20Ericsson\TEMS%20Pocket]] \\ [[https://cosconor.fr/GSM/Nokia/Netmonitor/TEMS/* K800i/]] and * T68 + T610/ \\ Sony Ericsson K790a N/A Sony Ericsson K790i R2B Sony Ericsson W995 R1K Sony Ericsson C702 R1E Sony Ericsson C905 R1D Sony Ericsson C905a R1D Sony Ericsson K800i R2B Sony Ericsson TM506 R1E Sony Ericsson W760i R1E Sony Ericsson Z750i R1F \\ [[https://gitea.osmocom.org/fixeria/sedbgmux|sedbgmux - DebugMux client]] \\ [[https://people.osmocom.org/fixeria/talks/osmodevcon/sedbgmux/sedbgmux.html#(1)|fixeria's reverse engineering DebugMux protocol]] and its [[https://media.ccc.de/v/osmodevcon2024-185-debugmux-getting-baseband-logs-from-old-sony-ericsson-phones|video version on media.ccc.de]] \\ ===== missing stuff / lost media ====== If you have/know any of the following files/info, pls let me know. \\ MISSING elfpack-libraries: http://archive.is/LT69I SimpleBiorhythm MinesweeperClone BreakCountdown AutoShutdown CODECLAW + Info Pages A2 Acoustics Editor (A2AE) SWF Info (SI) Sony Ericsson Layout Editor (SELE) AVX Editor (AE) Walkman 2.0 Patch Generator (W2PG) Walkman 2.0 Skin editor (W2SE) (FrontPaw) Extension Manager (EM) flash-menu-theme-connector FM + THM Joiner.rar: https://web.archive.org/web/20130831080505/http://forums.se-nse.net/topic/50127-flash-menu-theme-connector/ \\ https://web.archive.org/web/20120210094904/http://www.cybershut.com/archives/880 Mascot Capsule game Engine \\ phone emulator: https://www.youtube.com/watch?v=nLQpXbNyAH4 \\ se-stuff.net stuff\\ +tons of theme packs \\ Info about which service cables with smartcards are still active. \\ Omnius server-side-software (release as non_functional w/o DB! for RE) \\ Omnius source code \\