GSM-Forum - View Single Post

geohot · 01-22-2008, 03:44

So I was in walmart the other day and saw this phone for $11. I figured I'd pick it up and mess with it. I built a quick serial cable and got it working, but then started reading threads about how these phones can't be unlocked, except with a testpoint and the $350 infinity box. I have done a lot of work with the iPhone and have good reversing skills. I'll post what I've figured out so far; hopefully people can add to this.

@ 57600 baud, only two at commands appear to work
at -- echos OK
at+system=0 -- enter factory mode

The acer tool factory mode commands work, and I can read out the subsidy code, but the firmware is locked to TracFone.

@ 115200 baud, the phone prints "ftmtool" then one second later prints "error" I'm sure this is a flasher interface, but when I google "ftmtool", I get nothing at all.

Does anyone have docs on this phone, or more importantly a flash dump of a 8.8.17 TracFone?

01-22-2008, 03:44	#1 (permalink)
geohot Junior Member Join Date: Aug 2007 Posts: 8 Member: 567081 Status: Offline Thanks Meter: 4	C139 8.8.17 TracFone So I was in walmart the other day and saw this phone for $11. I figured I'd pick it up and mess with it. I built a quick serial cable and got it working, but then started reading threads about how these phones can't be unlocked, except with a testpoint and the $350 infinity box. I have done a lot of work with the iPhone and have good reversing skills. I'll post what I've figured out so far; hopefully people can add to this. @ 57600 baud, only two at commands appear to work at -- echos OK at+system=0 -- enter factory mode The acer tool factory mode commands work, and I can read out the subsidy code, but the firmware is locked to TracFone. @ 115200 baud, the phone prints "ftmtool" then one second later prints "error" I'm sure this is a flasher interface, but when I google "ftmtool", I get nothing at all. Does anyone have docs on this phone, or more importantly a flash dump of a 8.8.17 TracFone?