This is an old revision of the document!
Patches
Patches are saved as .vkp format, which is a renamed text file with description patch itself. Each patch line should start with an +offset to which address it is patched. You can revert patches as original content is first part after offset every line.
You can join patches into a single .vkp by adding +0 between two patches, which just resets the offset value. Comments are done with “;” in front till end of line
'must have' patches:
If you don't have SIM inside when you work on your phone, install patch for no SIM first.
See if there is are heapshift patches and apply the needed one.
Patch elfpack from https://justdanpo.ru/data/support/elfpack/, or see Farids versions. Elfloader is the only thing you'll really need.
On DB2020 flash QuickAccess (QA) vkp - mandatory for way faster connection for patching.
Tip: Copy/backup CXC in a state you have liked, then you do not have to reflash complete FW when you screw up patching. You can get clean cxc by extracting MAIN fw. If you use FAR manager for patching VKP, there is always a cached version locally: AppData\Roaming\farcxcpatcher\cache
Warning: I am not responsible. You can brick your phone (then just try to reflash). This is no guide, just a collection. Go read the warnings of everybody else, they apply here too.
ALWAYS make a backup your personal GDFS - FIRST!
See Link collection to find downloads.
Learn how to port patches yourself if you want to.
See these 4 video tutorials on YT:
https://www.youtube.com/watch?v=oDMDYai_Up0
https://www.youtube.com/watch?v=mG5Dj9EhkSU
https://www.youtube.com/watch?v=8OFonc2gkXM
https://www.youtube.com/watch?v=2iQrq8wgNY0
Patch porting tools downloaded somewhere 2011:
patch_porting_tools.zip
Get relevant tools from https://justdanpo.ru/data/projects/gsm/
use “read3150” also for DB3210 to retreive phone_app.cxc and use ida_cxcldr to open it in IDA
there is no .raw for A2, only for DB2010/20 (for which you use GExtract, main2raw and babe2raw)
VKP means V_Klay Patch which is taken from a patcher tool for Siemens known as V_Klay Patcher.
Original v1:
;Phone model and firmware version
;Description
;Recommendations (optional)
;(c) Author
;(p) Porter (if patch is ported from any other phone/firmware)
;(!) Important information, for example: (!) HeapShift. (optional)
;(i) Not important information (optional)
;(r) Respects (or nickname of man who provided any information for patch) (optional)
;(e) Nickname of man, who edited patch's code changing patch's functionality (optional) (optional)
The v2. if I may call this like that, is described in SEDEV Recovery Patch Help:
1. "Created" - C, c, Copyright Symbol, also can be used TradeMark Symbol, but this symbol currently is not recommended - tag for creators of the patch.
2. "Edited" - E, e - this covers modding, enhancing or other changes from base patch.
3. "Updated" - U, u - this covers updating and big fixing only. Updating means that the developer changes date / time / credits / some very small enhancing can be addressed as update too.
4. "Ported" - P, p - Only for crediting people who ported patch.
5. "Idea by" - I, i - Registered Symbol can also be used - this covers all who assisted in development ONLY.
6. The Information Symbol ( circle with "i" in the middle ) - Can be used to add (!) type information, if needed - for informative part ( non-tagged comment lines ), compatibility, requirement or other important data.
Open a dissassembler as IDA, apply the patch with the IDC script, disassemble it.
If you want to change it, write your .asm file and compile it with FASMARM.
1.- Open firmware in IDA (You know this step already?)
2.- Apply patch wih IDC script.
3.- Disassemble
4.- Make .asm file
5.- Port
6.- Reassemble
Download idc.rar: icd-download downloaded x times
Download ARM Patch Compiler.rar: A GUI for Armpc (by Edgpaez on 17 Jan 2009): downloaded x times
Entrypoint Converter 1.1
cxc2raw download
http://web.archive.org/web/20101128170128/http://se-developers.net/viewtopic.php?f=38&t=771
http://www.se-developers.net/viewtopic.php?f=38&t=771
Cxc2raw
by mc_kibel on 03 Feb 2010 12:53
Hello,
it's a simple app by me (thanks to ndt and den_po).
I was too lazy to run winhex everytime after using read3150 :D
Just drag'n'drop phone_app.cxc file on .exe, that's all.
It autmatically detect if cxc header is 0x1000 (phone) or 0x2000 (read3150), then app removes header.
By the way app will show some info about current .cxc, for example:
cxc2raw
(c) mc_kibel
Thanks: ndt, den_po
File from: Read3150.exe
Cxc file size:
->30881440b
->30157kb
->29mb
Cxc header size:
->0x2000
->8192b
Platform: DB3210
Firmware base address: 0x14000000
Succes!
Press any key to continue...
Edit: Little update, sorry for that :D Support phone_app.cxc from DB3150 / DB3210 / and added DB3350.
There is a new version of elf2vkp: https://github.com/siemens-mobile-hacks/elf2vkp
se-developers.net archived links:
[Tutorial] Porting and Compiling ASM files
using Smelter
VKP Patch Structure
[Tutorial] Making ASM File
[Tutorial] Advanced patch porting
Porting Lib Functions
Open Firmware with IDA
Calculate phone_app base address
ARM Assembly
Writing patch in IAR and using elf2vkp?
findbl_IDA-Plugin
http://www.se-developers.net/viewtopic.php?f=38&t=250
Also see se-developers.net archive
Find more, usefull stuff at mobilefree
Phone patches
#TODO: upload translated patches
C901 patches
In 2015 I have collected and saved all available patches on mobilefree.ru for C901 and google translated the non-english descriptions. I've repeated it with other forums.
c901_patches_mobilefree-2016.zip
Mandatory patches:
heapshift
elfpack
No-SIM patch
Keylock popup removal
video camera light as torch fix → see my torch elf “Torch901”
To me, C901 is the perfect latest bar type SE phone. W995/C905 are awesome CID53 A2 phones too, but I cannot arrange with a slider. Sony camera module is IMO pretty good for photos, even better with driver mod. Recording video only useable for quick snapshot. Fell in love with the video-led as torch, unfortunately A2 phones cannot dim LED. Created elfs for tracking free call minutes, hireminder for alarm triggered by accelerometer and modified SEns9x input bcfg controls because I liked playing it so much. And the not-so-KISS-anymore TorchC901 elf.
I've actively used it as daily driver till mid 2023 and do sometimes w/o SIM. I felt forced to have a 1+6 lineageOS-microG phone in the world of google apps :'(
I for myself joined the patches separated by '+0' and always flashed as a bunch. Following Is my personal archive of plugins for C901:
#TODO: add dl-link
K810 patches
K800 was my second SE phone type. It was a good phone and upgrade to K750. I loved the two top buttons in emulator games. The red camera focus LED could be used as flashlight. Decent photo camera with XENON flash. Had troubles with joystick, patch as workaround. M2 memory cards. Velour paint can get sticky after years (see lifehacks:liquid).
I had it crossflashed K800 → K810 with fixed drivers.
I did not go so deep with K800, but I want to share the messy collection of my HDD anyways.
Mandatory patches:
On DB2020, flash fast access vkp. mandatory for way faster connection for patching.
Tartes mod elfpack 1.9.2 ?
Heapshift
No-SIM patch
red-led flashlight + key-trigger customization and jar lcd-screen colour light
Joystick workaround
#TODO: add dl-link
W800 patches
K750 was my first Sony Ericsson phone, which was crossflashed to W800, as soon as I got to know what magic was out there.
It is a good phone and a huge upgrade to my first&old Nokia 3510i. Patching and modding was awesome, the world of J2ME apps discovered. Had trouble with joystick, patch as workaround. Dimmable LED flash was awesome torch, triggered by camera shutter and flashing on incoming call. Useable camera for its times. The start of personal good ringtones and iMY.
Following is the little stuff I have found on my HDD.
#TODO: add dl-link